Edit tour

Windows Analysis Report
RPHSNqfBjbKzV.dll

Overview

General Information

Sample name:	RPHSNqfBjbKzV.dll
Analysis ID:	1502266
MD5:	fda1dd36c546a292960d7d1b4514e4c2
SHA1:	485cbb48e01a940387782d27a3ebcd48ce324fc5
SHA256:	8160fedad806fe4e5a2dd8053e33c39236308c4e56c6a4043346b7f7a5d88684
Tags:	dll
Infos:

Detection

Score:	68
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Antivirus / Scanner detection for submitted sample

Multi AV Scanner detection for submitted file

AI detected suspicious sample

Machine Learning detection for sample

Tries to harvest and steal browser information (history, passwords, etc)

Contains functionality to check if a debugger is running (IsDebuggerPresent)

Contains functionality to check if a debugger is running (OutputDebugString,GetLastError)

Contains functionality to query locales information (e.g. system language)

Creates a process in suspended mode (likely to inject code)

Detected potential crypto function

Found evasive API chain (may stop execution after checking a module file name)

Found large amount of non-executed APIs

Program does not show much activity (idle)

Sample execution stops while process was sleeping (likely an evasion)

Uses 32bit PE files

Uses code obfuscation techniques (call, push, ret)

Classification

Process Tree

System is w10x64

loaddll32.exe (PID: 4488 cmdline: loaddll32.exe "C:\Users\user\Desktop\RPHSNqfBjbKzV.dll" MD5: 51E6071F9CBA48E79F10C84515AAE618)

conhost.exe (PID: 5096 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

cmd.exe (PID: 2784 cmdline: cmd.exe /C rundll32.exe "C:\Users\user\Desktop\RPHSNqfBjbKzV.dll",#1 MD5: D0FCE3AFA6AA1D58CE9FA336CC2B675B)

rundll32.exe (PID: 7096 cmdline: rundll32.exe "C:\Users\user\Desktop\RPHSNqfBjbKzV.dll",#1 MD5: 889B99C52A60DD49227C5E485A016679)

rundll32.exe (PID: 5252 cmdline: rundll32.exe C:\Users\user\Desktop\RPHSNqfBjbKzV.dll,#1 MD5: 889B99C52A60DD49227C5E485A016679)

rundll32.exe (PID: 6428 cmdline: rundll32.exe "C:\Users\user\Desktop\RPHSNqfBjbKzV.dll",#1 MD5: 889B99C52A60DD49227C5E485A016679)

cleanup

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Antivirus / Scanner detection for submitted sample

Source: RPHSNqfBjbKzV.dll

Avira: detected

Multi AV Scanner detection for submitted file

Source: RPHSNqfBjbKzV.dll

Virustotal: Detection: 41%

Perma Link

AI detected suspicious sample

Source: Submited Sample

Integrated Neural Analysis Model: Matched 99.9% probability

Machine Learning detection for sample

Source: RPHSNqfBjbKzV.dll

Joe Sandbox ML: detected

Source: RPHSNqfBjbKzV.dll

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE, DLL

Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 3_2_04B433B0	3_2_04B433B0
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 4_2_056333B0	4_2_056333B0
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 6_2_04EC33B0	6_2_04EC33B0

Source: RPHSNqfBjbKzV.dll

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE, DLL

Source: classification engine

Classification label: mal68.spyw.winDLL@10/0@0/0

Source: C:\Windows\System32\conhost.exe

Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:5096:120:WilError_03

Source: RPHSNqfBjbKzV.dll

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: C:\Windows\SysWOW64\rundll32.exe

File read: C:\Users\user\AppData\Roaming\Mozilla\Firefox\profiles.ini

Jump to behavior

Source: C:\Windows\System32\loaddll32.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: C:\Windows\System32\loaddll32.exe

Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe C:\Users\user\Desktop\RPHSNqfBjbKzV.dll,#1

Source: RPHSNqfBjbKzV.dll

Virustotal: Detection: 41%

Source: unknown	Process created: C:\Windows\System32\loaddll32.exe loaddll32.exe "C:\Users\user\Desktop\RPHSNqfBjbKzV.dll"
Source: C:\Windows\System32\loaddll32.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\loaddll32.exe	Process created: C:\Windows\SysWOW64\cmd.exe cmd.exe /C rundll32.exe "C:\Users\user\Desktop\RPHSNqfBjbKzV.dll",#1
Source: C:\Windows\System32\loaddll32.exe	Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe C:\Users\user\Desktop\RPHSNqfBjbKzV.dll,#1
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe "C:\Users\user\Desktop\RPHSNqfBjbKzV.dll",#1
Source: C:\Windows\System32\loaddll32.exe	Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe "C:\Users\user\Desktop\RPHSNqfBjbKzV.dll",#1
Source: C:\Windows\System32\loaddll32.exe	Process created: C:\Windows\SysWOW64\cmd.exe cmd.exe /C rundll32.exe "C:\Users\user\Desktop\RPHSNqfBjbKzV.dll",#1	Jump to behavior
Source: C:\Windows\System32\loaddll32.exe	Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe C:\Users\user\Desktop\RPHSNqfBjbKzV.dll,#1	Jump to behavior
Source: C:\Windows\System32\loaddll32.exe	Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe "C:\Users\user\Desktop\RPHSNqfBjbKzV.dll",#1	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe "C:\Users\user\Desktop\RPHSNqfBjbKzV.dll",#1	Jump to behavior

Source: C:\Windows\System32\loaddll32.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Windows\System32\loaddll32.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Section loaded: apphelp.dll	Jump to behavior

Source: RPHSNqfBjbKzV.dll

Static file information: File size 6829568 > 1048576

Source: RPHSNqfBjbKzV.dll

Static PE information: Raw size of .data is bigger than: 0x100000 < 0x5ec600

Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 3_2_04B43395 push ecx; ret	3_2_04B433A8
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 3_2_04B564F0 push eax; ret	3_2_04B5650E
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 4_2_056464F0 push eax; ret	4_2_0564650E
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 4_2_05633395 push ecx; ret	4_2_056333A8
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 6_2_04ED64F0 push eax; ret	6_2_04ED650E
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 6_2_04EC3395 push ecx; ret	6_2_04EC33A8

Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Source: C:\Windows\SysWOW64\rundll32.exe

Evasive API call chain: GetModuleFileName,DecisionNodes,ExitProcess

graph_3-1425

Source: C:\Windows\SysWOW64\rundll32.exe	API coverage: 3.4 %
Source: C:\Windows\SysWOW64\rundll32.exe	API coverage: 3.4 %
Source: C:\Windows\SysWOW64\rundll32.exe	API coverage: 2.0 %

Source: all processes

Thread injection, dropped files, key value created, disk infection and DNS query: no activity detected

Source: C:\Windows\System32\conhost.exe

Last function: Thread delayed

Source: C:\Windows\System32\loaddll32.exe

Thread delayed: delay time: 120000

Jump to behavior

Source: C:\Windows\SysWOW64\rundll32.exe	API call chain: ExitProcess graph end node	graph_3-1426
Source: C:\Windows\SysWOW64\rundll32.exe	API call chain: ExitProcess graph end node
Source: C:\Windows\SysWOW64\rundll32.exe	API call chain: ExitProcess graph end node

Source: C:\Windows\SysWOW64\rundll32.exe

Code function: 3_2_04B4422B _memset,IsDebuggerPresent,

3_2_04B4422B

Source: C:\Windows\SysWOW64\rundll32.exe

Code function: 3_2_04B4F0EF EncodePointer,EncodePointer,___crtIsPackagedApp,LoadLibraryExW,GetLastError,LoadLibraryExW,GetProcAddress,EncodePointer,GetProcAddress,EncodePointer,GetProcAddress,EncodePointer,GetProcAddress,EncodePointer,GetProcAddress,EncodePointer,IsDebuggerPresent,OutputDebugStringW,DecodePointer,DecodePointer,DecodePointer,DecodePointer,DecodePointer,DecodePointer,DecodePointer,

3_2_04B4F0EF

Source: all processes

Thread injection, dropped files, key value created, disk infection and DNS query: no activity detected

Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 3_2_04B411A4 SetUnhandledExceptionFilter,UnhandledExceptionFilter,	3_2_04B411A4
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 4_2_056311A4 SetUnhandledExceptionFilter,UnhandledExceptionFilter,	4_2_056311A4
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 6_2_04EC11A4 SetUnhandledExceptionFilter,UnhandledExceptionFilter,	6_2_04EC11A4

Source: C:\Windows\SysWOW64\cmd.exe

Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe "C:\Users\user\Desktop\RPHSNqfBjbKzV.dll",#1

Jump to behavior

Source: C:\Windows\SysWOW64\rundll32.exe	Code function: __IsNonwritableInCurrentImage,___crtGetLocaleInfoA,GetLastError,___crtGetLocaleInfoA,__calloc_crt,___crtGetLocaleInfoA,__calloc_crt,_free,_free,__calloc_crt,_free,__invoke_watson,	3_2_04B433B0
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: GetLocaleInfoW,	3_2_04B42C29
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: _LocaleUpdate::_LocaleUpdate,__crtGetLocaleInfoA_stat,	3_2_04B4E1C6
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: _LocaleUpdate::_LocaleUpdate,__crtGetLocaleInfoA_stat,	4_2_0563E1C6
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: GetLocaleInfoW,	4_2_05632C29
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: __IsNonwritableInCurrentImage,___crtGetLocaleInfoA,GetLastError,___crtGetLocaleInfoA,__calloc_crt,___crtGetLocaleInfoA,__calloc_crt,_free,_free,__calloc_crt,_free,__invoke_watson,	4_2_056333B0
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: _LocaleUpdate::_LocaleUpdate,__crtGetLocaleInfoA_stat,	6_2_04ECE1C6
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: __IsNonwritableInCurrentImage,___crtGetLocaleInfoA,GetLastError,___crtGetLocaleInfoA,__calloc_crt,___crtGetLocaleInfoA,__calloc_crt,_free,_free,__calloc_crt,_free,__invoke_watson,	6_2_04EC33B0
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: GetLocaleInfoW,	6_2_04EC2C29

Stealing of Sensitive Information

Tries to harvest and steal browser information (history, passwords, etc)

Source: C:\Windows\SysWOW64\rundll32.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\profiles.ini	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Storage\leveldb\MANIFEST-000001	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\webappsstore.sqlite	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Storage\leveldb\CURRENT	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Storage\leveldb\000003.log	Jump to behavior

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	1 Native API	1 DLL Side-Loading	11 Process Injection	1 Rundll32	1 OS Credential Dumping	2 Security Software Discovery	Remote Services	1 Archive Collected Data	1 Encrypted Channel	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	Scheduled Task/Job	Boot or Logon Initialization Scripts	1 DLL Side-Loading	1 Virtualization/Sandbox Evasion	LSASS Memory	1 Virtualization/Sandbox Evasion	Remote Desktop Protocol	1 Data from Local System	Junk Data	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	Logon Script (Windows)	11 Process Injection	Security Account Manager	1 File and Directory Discovery	SMB/Windows Admin Shares	Data from Network Shared Drive	Steganography	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	1 DLL Side-Loading	NTDS	11 System Information Discovery	Distributed Component Object Model	Input Capture	Protocol Impersonation	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	1 Obfuscated Files or Information	LSA Secrets	Internet Connection Discovery	SSH	Keylogging	Fallback Channels	Scheduled Transfer	Data Encrypted for Impact

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
RPHSNqfBjbKzV.dll	42%	Virustotal		Browse
RPHSNqfBjbKzV.dll	100%	Avira	HEUR/AGEN.1300638
RPHSNqfBjbKzV.dll	100%	Joe Sandbox ML

Joe Sandbox version:	40.0.0 Tourmaline
Analysis ID:	1502266
Start date and time:	2024-08-31 22:02:09 +02:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 2m 14s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	7
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	RPHSNqfBjbKzV.dll
Detection:	MAL
Classification:	mal68.spyw.winDLL@10/0@0/0
EGA Information:	Successful, ratio: 100%
HCA Information:	Failed
Cookbook Comments:	Found application associated with file extension: .dll Stop behavior analysis, all processes terminated

Warnings

Exclude process from analysis (whitelisted): dllhost.exe
Excluded domains from analysis (whitelisted): client.wns.windows.com
Not all processes where analyzed, report is missing behavior information

Simulations

Behavior and APIs

Time	Type	Description
16:03:01	API Interceptor	1x Sleep call for process: loaddll32.exe modified

File type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Entropy (8bit):	7.7927298785282595
TrID:	Win32 Dynamic Link Library (generic) (1002004/3) 99.60% Generic Win/DOS Executable (2004/3) 0.20% DOS Executable Generic (2002/1) 0.20% Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
File name:	RPHSNqfBjbKzV.dll
File size:	6'829'568 bytes
MD5:	fda1dd36c546a292960d7d1b4514e4c2
SHA1:	485cbb48e01a940387782d27a3ebcd48ce324fc5
SHA256:	8160fedad806fe4e5a2dd8053e33c39236308c4e56c6a4043346b7f7a5d88684
SHA512:	900c93b5cc2edddaed36ea681ade81ab6b8b5d668f7f4ec5405da041456a665ce9145dce45082e473e846cd92bb020c3534a4addf289d6c40d198574cc383f28
SSDEEP:	98304:QWfg5fRmhQ1orSk3GCK4J7vADNR6oXc0/8+x0bRtI4PPgbYhiLC9kEN6+/mu:zfEfiQ15M2aIDS0i+SRi4samC9bN9O
TLSH:	ED662215A200C21AF5D21176355807BE80B83F3053A515CBBBD93B09AEF96D9ED37BA3
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.............._..._..._..._..._..-_..._..,__.._Zv._..._..._+.._2.)_..._2.-_..._2.._..._2.._..._Rich..._........PE..L......a...........

File Icon


Icon Hash:	7ae282899bbab082

Static PE Info

General

Entrypoint:	0x10074c6c
Entrypoint Section:	.text
Digitally signed:	false
Imagebase:	0x10000000
Subsystem:	windows gui
Image File Characteristics:	EXECUTABLE_IMAGE, 32BIT_MACHINE, DLL
DLL Characteristics:	NX_COMPAT
Time Stamp:	0x617FA0D6 [Mon Nov 1 08:09:58 2021 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	6
OS Version Minor:	0
File Version Major:	6
File Version Minor:	0
Subsystem Version Major:	6
Subsystem Version Minor:	0
Import Hash:	e26f062d8a4cdad75aed86099b07e435

Entrypoint Preview

Instruction
push ebp
mov ebp, esp
cmp dword ptr [ebp+0Ch], 01h
jne 00007FA924D3ECD7h
call 00007FA924D4B69Bh
push dword ptr [ebp+10h]
push dword ptr [ebp+0Ch]
push dword ptr [ebp+08h]
call 00007FA924D3ECDCh
add esp, 0Ch
pop ebp
retn 000Ch
push 0000000Ch
push 10092DF8h
call 00007FA924D4367Ah
xor eax, eax
inc eax
mov esi, dword ptr [ebp+0Ch]
test esi, esi
jne 00007FA924D3ECDEh
cmp dword ptr [106808FCh], esi
je 00007FA924D3EDBAh
and dword ptr [ebp-04h], 00000000h
cmp esi, 01h
je 00007FA924D3ECD7h
cmp esi, 02h
jne 00007FA924D3ED07h
mov ecx, dword ptr [10002C44h]
test ecx, ecx
je 00007FA924D3ECDEh
push dword ptr [ebp+10h]
push esi
push dword ptr [ebp+08h]
call ecx
mov dword ptr [ebp-1Ch], eax
test eax, eax
je 00007FA924D3ED87h
push dword ptr [ebp+10h]
push esi
push dword ptr [ebp+08h]
call 00007FA924D3EAE6h
mov dword ptr [ebp-1Ch], eax
test eax, eax
je 00007FA924D3ED70h
mov ebx, dword ptr [ebp+10h]
push ebx
push esi
push dword ptr [ebp+08h]
call 00007FA924D4B6B0h
mov edi, eax
mov dword ptr [ebp-1Ch], edi
cmp esi, 01h
jne 00007FA924D3ECFAh
test edi, edi
jne 00007FA924D3ECF6h
push ebx
push eax
push dword ptr [ebp+08h]
call 00007FA924D4B698h
push ebx
push edi
push dword ptr [ebp+08h]
call 00007FA924D3EAACh
mov eax, dword ptr [10002C44h]
test eax, eax
je 00007FA924D3ECD9h
push ebx
push edi
push dword ptr [ebp+08h]
call eax

Rich Headers

Programming Language:

[ASM] VS2013 build 21005
[C++] VS2013 build 21005
[ C ] VS2013 build 21005
[C++] VS2013 UPD5 build 40629
[EXP] VS2013 UPD5 build 40629
[LNK] VS2013 UPD5 build 40629

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x93390	0x39	.text
IMAGE_DIRECTORY_ENTRY_IMPORT	0x68329c	0x64	.idata
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x0	0x0
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x685000	0x3530	.reloc
IMAGE_DIRECTORY_ENTRY_DEBUG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x82c8	0x40	.text
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x683000	0x29c	.idata
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x1000	0x923c9	0x92400	286e71ffa89687b1f1fdde465cafc4a4	False	0.4771016960470085	data	6.36255048499477	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.data	0x94000	0x5eea08	0x5ec600	0c532256dd48ba2fa7e132858e6818fb	unknown	unknown	unknown	unknown	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.idata	0x683000	0x1126	0x1200	93e2393326b84eb4a55c28b7a4fa258b	False	0.4474826388888889	data	5.399566335836943	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.reloc	0x685000	0x3530	0x3600	28d655c078bfe08bf684b306c9e9c85a	False	0.7255497685185185	data	6.55019272587033	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ

Imports

DLL	Import
KERNEL32.dll	GetModuleFileNameW, FreeEnvironmentStringsW, GetEnvironmentStringsW, GetCurrentProcessId, QueryPerformanceCounter, SetFilePointerEx, ReadFile, GetConsoleMode, GetConsoleCP, WriteFile, CloseHandle, GetFileType, SetStdHandle, GetOEMCP, IsValidCodePage, IsDebuggerPresent, GetProcessHeap, HeapSize, AreFileApisANSI, GetModuleHandleExW, ExitProcess, EnumSystemLocalesW, GetUserDefaultLCID, LCMapStringW, CompareStringW, IsProcessorFeaturePresent, WriteConsoleW, ReadConsoleW, WaitForSingleObject, GetExitCodeProcess, GetFileAttributesExW, OutputDebugStringW, CreateFileW, SetEnvironmentVariableA, ExpandEnvironmentStringsW, LocalFree, TlsAlloc, DeleteCriticalSection, GetModuleFileNameA, EnterCriticalSection, FindFirstFileA, FlushFileBuffers, GetACP, MulDiv, GetEnvironmentVariableW, GetSystemTimeAdjustment, InitializeCriticalSectionAndSpinCount, ClearCommBreak, ExpandEnvironmentStringsA, GetCurrentThread, GetTickCount, ConnectNamedPipe, GetCurrentProcess, GetCommState, VirtualQuery, SetLastError, CreateProcessA, GetLocaleInfoW, IsValidLocale, WideCharToMultiByte, LoadLibraryExW, GetLocaleInfoA, GetStdHandle, LeaveCriticalSection, EncodePointer, DecodePointer, MultiByteToWideChar, GetStringTypeW, GetLastError, HeapReAlloc, GetSystemTimeAsFileTime, RaiseException, RtlUnwind, HeapFree, GetCommandLineA, GetCurrentThreadId, GetCPInfo, HeapAlloc, UnhandledExceptionFilter, SetUnhandledExceptionFilter, Sleep, TerminateProcess, TlsGetValue, TlsSetValue, TlsFree, GetStartupInfoW, GetModuleHandleW, GetProcAddress, SetEndOfFile
USER32.dll	EndPaint, GetMessageA, IsIconic, LoadStringA, GetWindowInfo, SetFocus, CreateIconIndirect, WaitMessage, GetCapture, GetWindowTextA, UnionRect, PeekMessageA, EndDialog, DefWindowProcA, CheckDlgButton, MessageBoxW, ReleaseCapture, GetSystemMetrics, ToUnicode, TranslateMDISysAccel, SetCursor, DestroyAcceleratorTable, MapDialogRect, SetKeyboardState, SetParent, CreateMenu, GetDC, CheckMenuRadioItem, GetScrollInfo, SystemParametersInfoW, GetDlgItem, GetDesktopWindow, GetSysColor, InsertMenuA, GetDlgItemTextA, DestroyIcon, CheckMenuItem, GetMessageTime, IsRectEmpty
GDI32.dll	ExtCreatePen, Arc, GdiFlush, CreateHalftonePalette, GetRgnBox, SetPixel, CreateBitmap, GetPaletteEntries, CreateCompatibleDC, SetPolyFillMode, StretchDIBits, GetNearestPaletteIndex, RoundRect, CreateDIBitmap, RestoreDC, SetViewportOrgEx, SetWindowExtEx, Polygon, CreateRectRgnIndirect, Ellipse, GetTextExtentPointW, GetCharWidth32A, GetCharABCWidthsFloatA, Polyline, SetViewportExtEx, GetPixel, CloseEnhMetaFile, CreateSolidBrush, SaveDC
ADVAPI32.dll	GetLengthSid, LookupPrivilegeValueW, SetSecurityDescriptorDacl, GetUserNameA, RegOpenKeyExW, AllocateAndInitializeSid

Target ID:	0
Start time:	16:02:58
Start date:	31/08/2024
Path:	C:\Windows\System32\loaddll32.exe
Wow64 process (32bit):	true
Commandline:	loaddll32.exe "C:\Users\user\Desktop\RPHSNqfBjbKzV.dll"
Imagebase:	0xf0000
File size:	126'464 bytes
MD5 hash:	51E6071F9CBA48E79F10C84515AAE618
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	1
Start time:	16:02:58
Start date:	31/08/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff66e660000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	2
Start time:	16:02:58
Start date:	31/08/2024
Path:	C:\Windows\SysWOW64\cmd.exe
Wow64 process (32bit):	true
Commandline:	cmd.exe /C rundll32.exe "C:\Users\user\Desktop\RPHSNqfBjbKzV.dll",#1
Imagebase:	0x1c0000
File size:	236'544 bytes
MD5 hash:	D0FCE3AFA6AA1D58CE9FA336CC2B675B
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	3
Start time:	16:02:58
Start date:	31/08/2024
Path:	C:\Windows\SysWOW64\rundll32.exe
Wow64 process (32bit):	true
Commandline:	rundll32.exe C:\Users\user\Desktop\RPHSNqfBjbKzV.dll,#1
Imagebase:	0x450000
File size:	61'440 bytes
MD5 hash:	889B99C52A60DD49227C5E485A016679
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	4
Start time:	16:02:58
Start date:	31/08/2024
Path:	C:\Windows\SysWOW64\rundll32.exe
Wow64 process (32bit):	true
Commandline:	rundll32.exe "C:\Users\user\Desktop\RPHSNqfBjbKzV.dll",#1
Imagebase:	0x450000
File size:	61'440 bytes
MD5 hash:	889B99C52A60DD49227C5E485A016679
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	6
Start time:	16:03:01
Start date:	31/08/2024
Path:	C:\Windows\SysWOW64\rundll32.exe
Wow64 process (32bit):	true
Commandline:	rundll32.exe "C:\Users\user\Desktop\RPHSNqfBjbKzV.dll",#1
Imagebase:	0x450000
File size:	61'440 bytes
MD5 hash:	889B99C52A60DD49227C5E485A016679
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Execution Graph

Execution Coverage:	1.4%
Dynamic/Decrypted Code Coverage:	100%
Signature Coverage:	14.1%
Total number of Nodes:	626
Total number of Limit Nodes:	7

Callgraph

Executed
Not Executed
Opacity -> Relevance
Disassembly available

Non-executed Functions

Function 04B411A4 Relevance: 3.0, APIs: 2, Instructions: 8
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

SetUnhandledExceptionFilter.KERNEL32(00000000,?,04B4BB0A,04A2768C,00000001,?,04B4BC21,04A2768C,00000017), ref: 04B411A9
UnhandledExceptionFilter.KERNEL32(04A2768C,?,04B4BB0A,04A2768C,00000001,?,04B4BC21,04A2768C,00000017), ref: 04B411B2

Memory Dump Source

Source File: 00000003.00000002.2114107639.0000000004A21000.00000020.00001000.00020000.00000000.sdmp, Offset: 04A20000, based on PE: true

Associated: 00000003.00000002.2114089319.0000000004A20000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2114268025.0000000004B7A000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2114596375.0000000004FED000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2114614077.0000000004FEF000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_4a20000_rundll32.jbxd

Similarity

API ID: ExceptionFilterUnhandled
String ID:
API String ID: 3192549508-0
Opcode ID: 15e987a91c3f68138aa645cd747507929adc302bf4dfa96b2b864214913dfc0d
Instruction ID: 46bdf1c40f9bede1fa6d3da6c8959b0d0573092013c7d61c81d671a881d1f576
Opcode Fuzzy Hash: 15e987a91c3f68138aa645cd747507929adc302bf4dfa96b2b864214913dfc0d
Instruction Fuzzy Hash: BFB0923104420EABEA002FD2F809F98BF28EB84663F000010F60D4C8628BAA9851CA92

Function 04B42C29 Relevance: 1.5, APIs: 1, Instructions: 18
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetLocaleInfoW.KERNEL32(00000000,?,00000002,?,?,04B436FA,?,?,?,00000002,?,?,?), ref: 04B42C50

Memory Dump Source

Source File: 00000003.00000002.2114107639.0000000004A21000.00000020.00001000.00020000.00000000.sdmp, Offset: 04A20000, based on PE: true

Associated: 00000003.00000002.2114089319.0000000004A20000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2114268025.0000000004B7A000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2114596375.0000000004FED000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2114614077.0000000004FEF000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_4a20000_rundll32.jbxd

Similarity

API ID: InfoLocale
String ID:
API String ID: 2299586839-0
Opcode ID: 8159cb849f090a220336b98d8261ae503636ad92dd4be73974d94d1aeedf06fc
Instruction ID: 80650fdf1ddb70fe6f971b02929217f9d0bd685647b06043c3410f185db18c02
Opcode Fuzzy Hash: 8159cb849f090a220336b98d8261ae503636ad92dd4be73974d94d1aeedf06fc
Instruction Fuzzy Hash: 04D0673600120DBF9F05EFE5F845C6A3B69FB8C365B044885F9188A511D63BB920AB65

Description:	Adversaries may interact with the native OS application programming interface (API) to execute behaviors. Native APIs provide a controlled means of calling low-level OS services within the kernel, such as those involving hardware/devices, memory, and processes.These native APIs are leveraged by the OS during system boot (when other system components are not yet initialized) as well as carrying out tasks and requests during routine operations.
Tactics:	Execution
Data Sources:	Module: Module Load, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse rundll32.exe to proxy execution of malicious code. Using rundll32.exe, vice executing directly (i.e. Shared Modules ), may avoid triggering security tools that may not monitor execution of the rundll32.exe process because of allowlists or false positives from normal operations. Rundll32.exe is commonly associated with executing DLL payloads (ex: `rundll32.exe {DLLname, DLLfunction}` ).
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to dump credentials to obtain account login and credential material, normally in the form of a hash or a clear text password, from the operating system and software. Credentials can then be used to perform Lateral Movement and access restricted information.
Tactics:	Credential Access
Data Sources:	Active Directory: Active Directory Object Access, Command: Command Execution, File: File Access, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Access, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may search local system sources, such as file systems and configuration files or local databases, to find files of interest and sensitive data prior to Exfiltration.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Access, Process: OS API Execution, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report RPHSNqfBjbKzV.dll

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Yara Signatures

Sigma Signatures

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Compliance

System Summary

Data Obfuscation

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Stealing of Sensitive Information

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

World Map of Contacted IPs

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

Static File Info

General

File Icon

Static PE Info

General

Entrypoint Preview

Rich Headers

Data Directories

Sections

Imports

Network Behavior

Statistics

CPU Usage

Memory Usage

High Level Behavior Distribution

back

Behavior

System Behavior

Analysis Process: loaddll32.exePID: 4488, Parent PID: 4004

General

Chronological Activities

Analysis Process: conhost.exePID: 5096, Parent PID: 4488

General

Chronological Activities

Analysis Process: cmd.exePID: 2784, Parent PID: 4488

General

Chronological Activities

Windows Analysis Report
RPHSNqfBjbKzV.dll

Function 04B411A4 Relevance: 3.0, APIs: 2, Instructions: 8
COMMONLIBRARYCODE

Function 04B42C29 Relevance: 1.5, APIs: 1, Instructions: 18
COMMONLIBRARYCODE