Windows Analysis Report
yjF33u9fqZ.dll

Overview

General Information

Sample name: yjF33u9fqZ.dll
(renamed file extension from exe to dll, renamed because original name is a hash value)
Original sample name: a689d6c88b72b5b148ac581fcbe71902.dll.exe
Analysis ID: 1561761
MD5: a689d6c88b72b5b148ac581fcbe71902
SHA1: 7fe590156c8b831e0033fc971a90a949ce50f085
SHA256: 410cbc2d187ca80ce22eadb4fbe77d5af071bc7c9f747f50e2ddf765167ba7d4
Tags: dllexeStrelaStealeruser-abuse_ch
Infos:

Detection

Strela Stealer
Score: 60
Range: 0 - 100
Whitelisted: false
Confidence: 100%

Signatures

Multi AV Scanner detection for submitted file
Yara detected Strela Stealer
Machine Learning detection for sample
Contains functionality to query locales information (e.g. system language)
Creates a process in suspended mode (likely to inject code)
Detected potential crypto function
PE file does not import any functions
Program does not show much activity (idle)
Registers a DLL
Sample execution stops while process was sleeping (likely an evasion)
Uses code obfuscation techniques (call, push, ret)

Classification

AV Detection
barindex
Multi AV Scanner detection for submitted file
Source: yjF33u9fqZ.dll ReversingLabs: Detection: 50%
Source: yjF33u9fqZ.dll Virustotal: Detection: 50% Perma Link
Machine Learning detection for sample
Source: yjF33u9fqZ.dll Joe Sandbox ML: detected
Source: yjF33u9fqZ.dll Static PE information: HIGH_ENTROPY_VA, DYNAMIC_BASE, NX_COMPAT
Detected potential crypto function
Source: C:\Windows\System32\loaddll64.exe Code function: 0_2_00007FFBC31D1000 0_2_00007FFBC31D1000
Source: C:\Windows\System32\loaddll64.exe Code function: 0_2_0000023BEAF215A0 0_2_0000023BEAF215A0
Source: C:\Windows\System32\loaddll64.exe Code function: 0_2_0000023BEAF2F4E8 0_2_0000023BEAF2F4E8
Source: C:\Windows\System32\loaddll64.exe Code function: 0_2_0000023BEAF272BC 0_2_0000023BEAF272BC
Source: C:\Windows\System32\loaddll64.exe Code function: 0_2_0000023BEAF21A90 0_2_0000023BEAF21A90
Source: C:\Windows\System32\loaddll64.exe Code function: 0_2_0000023BEAF21090 0_2_0000023BEAF21090
Source: C:\Windows\System32\regsvr32.exe Code function: 3_2_027172BC 3_2_027172BC
Source: C:\Windows\System32\regsvr32.exe Code function: 3_2_02711A90 3_2_02711A90
Source: C:\Windows\System32\regsvr32.exe Code function: 3_2_0271F4E8 3_2_0271F4E8
Source: C:\Windows\System32\regsvr32.exe Code function: 3_2_02711090 3_2_02711090
Source: C:\Windows\System32\regsvr32.exe Code function: 3_2_027115A0 3_2_027115A0
Source: C:\Windows\System32\rundll32.exe Code function: 5_2_00000186B59A1A90 5_2_00000186B59A1A90
Source: C:\Windows\System32\rundll32.exe Code function: 5_2_00000186B59A72BC 5_2_00000186B59A72BC
Source: C:\Windows\System32\rundll32.exe Code function: 5_2_00000186B59A15A0 5_2_00000186B59A15A0
Source: C:\Windows\System32\rundll32.exe Code function: 5_2_00000186B59AF4E8 5_2_00000186B59AF4E8
Source: C:\Windows\System32\rundll32.exe Code function: 5_2_00000186B59A1090 5_2_00000186B59A1090
Source: C:\Windows\System32\rundll32.exe Code function: 6_2_000002AB0BF3F4E8 6_2_000002AB0BF3F4E8
Source: C:\Windows\System32\rundll32.exe Code function: 6_2_000002AB0BF31090 6_2_000002AB0BF31090
Source: C:\Windows\System32\rundll32.exe Code function: 6_2_000002AB0BF372BC 6_2_000002AB0BF372BC
Source: C:\Windows\System32\rundll32.exe Code function: 6_2_000002AB0BF31A90 6_2_000002AB0BF31A90
Source: C:\Windows\System32\rundll32.exe Code function: 6_2_000002AB0BF315A0 6_2_000002AB0BF315A0
PE file does not import any functions
Source: yjF33u9fqZ.dll Static PE information: No import functions for PE file found
Source: classification engine Classification label: mal60.troj.winDLL@10/0@0/0
Source: C:\Windows\System32\conhost.exe Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:3712:120:WilError_03
Source: yjF33u9fqZ.dll Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
Source: C:\Windows\System32\loaddll64.exe Key opened: HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers Jump to behavior
Source: C:\Windows\System32\loaddll64.exe Process created: C:\Windows\System32\rundll32.exe rundll32.exe C:\Users\user\Desktop\yjF33u9fqZ.dll,DllRegisterServer
Source: yjF33u9fqZ.dll ReversingLabs: Detection: 50%
Source: yjF33u9fqZ.dll Virustotal: Detection: 50%
Source: unknown Process created: C:\Windows\System32\loaddll64.exe loaddll64.exe "C:\Users\user\Desktop\yjF33u9fqZ.dll"
Source: C:\Windows\System32\loaddll64.exe Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\loaddll64.exe Process created: C:\Windows\System32\cmd.exe cmd.exe /C rundll32.exe "C:\Users\user\Desktop\yjF33u9fqZ.dll",#1
Source: C:\Windows\System32\loaddll64.exe Process created: C:\Windows\System32\regsvr32.exe regsvr32.exe /s C:\Users\user\Desktop\yjF33u9fqZ.dll
Source: C:\Windows\System32\loaddll64.exe Process created: C:\Windows\System32\rundll32.exe rundll32.exe C:\Users\user\Desktop\yjF33u9fqZ.dll,DllRegisterServer
Source: C:\Windows\System32\cmd.exe Process created: C:\Windows\System32\rundll32.exe rundll32.exe "C:\Users\user\Desktop\yjF33u9fqZ.dll",#1
Source: C:\Windows\System32\loaddll64.exe Process created: C:\Windows\System32\cmd.exe cmd.exe /C rundll32.exe "C:\Users\user\Desktop\yjF33u9fqZ.dll",#1 Jump to behavior
Source: C:\Windows\System32\loaddll64.exe Process created: C:\Windows\System32\regsvr32.exe regsvr32.exe /s C:\Users\user\Desktop\yjF33u9fqZ.dll Jump to behavior
Source: C:\Windows\System32\loaddll64.exe Process created: C:\Windows\System32\rundll32.exe rundll32.exe C:\Users\user\Desktop\yjF33u9fqZ.dll,DllRegisterServer Jump to behavior
Source: C:\Windows\System32\cmd.exe Process created: C:\Windows\System32\rundll32.exe rundll32.exe "C:\Users\user\Desktop\yjF33u9fqZ.dll",#1 Jump to behavior
Source: C:\Windows\System32\loaddll64.exe Section loaded: apphelp.dll Jump to behavior
Source: C:\Windows\System32\loaddll64.exe Section loaded: wininet.dll Jump to behavior
Source: C:\Windows\System32\loaddll64.exe Section loaded: textshaping.dll Jump to behavior
Source: C:\Windows\System32\loaddll64.exe Section loaded: uxtheme.dll Jump to behavior
Source: C:\Windows\System32\loaddll64.exe Section loaded: kernel.appcore.dll Jump to behavior
Source: C:\Windows\System32\loaddll64.exe Section loaded: textinputframework.dll Jump to behavior
Source: C:\Windows\System32\loaddll64.exe Section loaded: coreuicomponents.dll Jump to behavior
Source: C:\Windows\System32\loaddll64.exe Section loaded: coremessaging.dll Jump to behavior
Source: C:\Windows\System32\loaddll64.exe Section loaded: ntmarta.dll Jump to behavior
Source: C:\Windows\System32\loaddll64.exe Section loaded: wintypes.dll Jump to behavior
Source: C:\Windows\System32\loaddll64.exe Section loaded: wintypes.dll Jump to behavior
Source: C:\Windows\System32\loaddll64.exe Section loaded: wintypes.dll Jump to behavior
Source: C:\Windows\System32\regsvr32.exe Section loaded: apphelp.dll Jump to behavior
Source: C:\Windows\System32\regsvr32.exe Section loaded: aclayers.dll Jump to behavior
Source: C:\Windows\System32\regsvr32.exe Section loaded: sfc.dll Jump to behavior
Source: C:\Windows\System32\regsvr32.exe Section loaded: sfc_os.dll Jump to behavior
Source: C:\Windows\System32\regsvr32.exe Section loaded: kernel.appcore.dll Jump to behavior
Source: C:\Windows\System32\regsvr32.exe Section loaded: uxtheme.dll Jump to behavior
Source: C:\Windows\System32\regsvr32.exe Section loaded: wininet.dll Jump to behavior
Source: C:\Windows\System32\regsvr32.exe Section loaded: textshaping.dll Jump to behavior
Source: C:\Windows\System32\regsvr32.exe Section loaded: textinputframework.dll Jump to behavior
Source: C:\Windows\System32\regsvr32.exe Section loaded: coreuicomponents.dll Jump to behavior
Source: C:\Windows\System32\regsvr32.exe Section loaded: coremessaging.dll Jump to behavior
Source: C:\Windows\System32\regsvr32.exe Section loaded: ntmarta.dll Jump to behavior
Source: C:\Windows\System32\regsvr32.exe Section loaded: coremessaging.dll Jump to behavior
Source: C:\Windows\System32\regsvr32.exe Section loaded: wintypes.dll Jump to behavior
Source: C:\Windows\System32\regsvr32.exe Section loaded: wintypes.dll Jump to behavior
Source: C:\Windows\System32\regsvr32.exe Section loaded: wintypes.dll Jump to behavior
Source: C:\Windows\System32\loaddll64.exe Automated click: OK
Source: C:\Windows\System32\regsvr32.exe Automated click: OK
Source: C:\Windows\System32\rundll32.exe Automated click: OK
Source: Window Recorder Window detected: More than 3 window changes detected
Source: yjF33u9fqZ.dll Static PE information: Image base 0x180000000 > 0x60000000
Source: yjF33u9fqZ.dll Static PE information: HIGH_ENTROPY_VA, DYNAMIC_BASE, NX_COMPAT
Registers a DLL
Source: C:\Windows\System32\loaddll64.exe Process created: C:\Windows\System32\regsvr32.exe regsvr32.exe /s C:\Users\user\Desktop\yjF33u9fqZ.dll
Uses code obfuscation techniques (call, push, ret)
Source: C:\Windows\System32\loaddll64.exe Code function: 0_2_0000023BEAF375DE push ecx; retf 003Fh 0_2_0000023BEAF3763E
Source: C:\Windows\System32\loaddll64.exe Code function: 0_2_0000023BEAF2BBA2 push esp; ret 0_2_0000023BEAF2BBA5
Source: C:\Windows\System32\loaddll64.exe Code function: 0_2_0000023BEAF31310 push esi; retf 0_2_0000023BEAF31313
Source: C:\Windows\System32\loaddll64.exe Code function: 0_2_0000023BEAF31318 push ebp; retf 0_2_0000023BEAF3131B
Source: C:\Windows\System32\loaddll64.exe Code function: 0_2_0000023BEAF31300 push ebp; retf 0_2_0000023BEAF31303
Source: C:\Windows\System32\loaddll64.exe Code function: 0_2_0000023BEAF3130A push esi; retf 0_2_0000023BEAF3130B
Source: C:\Windows\System32\loaddll64.exe Code function: 0_2_0000023BEAF312EC push ebp; retf 0_2_0000023BEAF312F3
Source: C:\Windows\System32\loaddll64.exe Code function: 0_2_0000023BEAF312FA push ebp; retf 0_2_0000023BEAF312FB
Source: C:\Windows\System32\loaddll64.exe Code function: 0_2_0000023BEAF312DC push ebp; retf 0_2_0000023BEAF312E3
Source: C:\Windows\System32\loaddll64.exe Code function: 0_2_0000023BEAF312E4 push ebp; retf 0_2_0000023BEAF312EB
Source: C:\Windows\System32\loaddll64.exe Code function: 0_2_0000023BEAF2CC9C push ebx; retf 0_2_0000023BEAF2CC9D
Source: C:\Windows\System32\loaddll64.exe Code function: 0_2_0000023BEAF2CCA8 push 6F0000CBh; retf 0_2_0000023BEAF2CCAD
Source: C:\Windows\System32\loaddll64.exe Code function: 0_2_0000023BEAF2CC6C push esi; retf 0000h 0_2_0000023BEAF2CC6D
Source: C:\Windows\System32\loaddll64.exe Code function: 0_2_0000023BEAF2CC35 push cs; retf 0000h 0_2_0000023BEAF2CC59
Source: C:\Windows\System32\loaddll64.exe Code function: 0_2_0000023BEAF311CC push ebp; retf 0_2_0000023BEAF311DB
Source: C:\Windows\System32\loaddll64.exe Code function: 0_2_0000023BEAF311BC push ebp; retf 0_2_0000023BEAF311CB
Source: C:\Windows\System32\loaddll64.exe Code function: 0_2_0000023BEAF31191 push esi; retf 0_2_0000023BEAF31193
Source: C:\Windows\System32\loaddll64.exe Code function: 0_2_0000023BEAF31194 push ebp; retf 0_2_0000023BEAF311BB
Source: C:\Windows\System32\loaddll64.exe Code function: 0_2_0000023BEAF3116C push ebp; retf 0_2_0000023BEAF3117B
Source: C:\Windows\System32\loaddll64.exe Code function: 0_2_0000023BEAF31150 push ebp; retf 0_2_0000023BEAF31153
Source: C:\Windows\System32\loaddll64.exe Code function: 0_2_0000023BEAF31154 push ebp; retf 0_2_0000023BEAF3116B
Source: C:\Windows\System32\loaddll64.exe Code function: 0_2_0000023BEAF3114A push esi; retf 0_2_0000023BEAF3114B
Source: C:\Windows\System32\loaddll64.exe Code function: 0_2_0000023BEAF3111C push esi; retf 0_2_0000023BEAF310FB
Source: C:\Windows\System32\loaddll64.exe Code function: 0_2_0000023BEAF3111C push esi; retf 0_2_0000023BEAF31143
Source: C:\Windows\System32\loaddll64.exe Code function: 0_2_0000023BEAF3110C push esi; retf 0_2_0000023BEAF31113
Source: C:\Windows\System32\loaddll64.exe Code function: 0_2_0000023BEAF31114 push esi; retf 0_2_0000023BEAF3111B
Source: C:\Windows\System32\loaddll64.exe Code function: 0_2_0000023BEAF310FC push ebp; retf 0_2_0000023BEAF3115B
Source: C:\Windows\System32\loaddll64.exe Code function: 0_2_0000023BEAF31104 push esi; retf 0_2_0000023BEAF3110B
Source: C:\Windows\System32\loaddll64.exe Code function: 0_2_0000023BEAF310EC push esi; retf 0_2_0000023BEAF310FB
Source: C:\Windows\System32\loaddll64.exe Code function: 0_2_0000023BEAF310DC push esi; retf 0_2_0000023BEAF310E3
Source: C:\Windows\System32\loaddll64.exe Code function: 0_2_0000023BEAF310E4 push esi; retf 0_2_0000023BEAF310EB
Source: C:\Windows\System32\rundll32.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\rundll32.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Program does not show much activity (idle)
Source: all processes Thread injection, dropped files, key value created, disk infection and DNS query: no activity detected
Sample execution stops while process was sleeping (likely an evasion)
Source: C:\Windows\System32\conhost.exe Last function: Thread delayed
Program does not show much activity (idle)
Source: all processes Thread injection, dropped files, key value created, disk infection and DNS query: no activity detected
Creates a process in suspended mode (likely to inject code)
Source: C:\Windows\System32\cmd.exe Process created: C:\Windows\System32\rundll32.exe rundll32.exe "C:\Users\user\Desktop\yjF33u9fqZ.dll",#1 Jump to behavior
Contains functionality to query locales information (e.g. system language)
Source: C:\Windows\System32\loaddll64.exe Code function: GetConsoleWindow,CreateThread,GetLocaleInfoA, 0_2_0000023BEAF220E0
Source: C:\Windows\System32\regsvr32.exe Code function: CreateThread,GetLocaleInfoA, 3_2_027120E0
Source: C:\Windows\System32\rundll32.exe Code function: CreateThread,GetLocaleInfoA, 5_2_00000186B59A20E0
Source: C:\Windows\System32\rundll32.exe Code function: CreateThread,GetLocaleInfoA, 6_2_000002AB0BF320E0

Stealing of Sensitive Information
barindex
Yara detected Strela Stealer
Source: Yara match File source: 6.2.rundll32.exe.7ffbc31d7404.1.unpack, type: UNPACKEDPE
Source: Yara match File source: 6.2.rundll32.exe.7ffbc31d0000.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 3.2.regsvr32.exe.7ffbc31d7404.1.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 0.2.loaddll64.exe.7ffbc31d7404.1.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 6.2.rundll32.exe.7ffbc31d7404.1.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 3.2.regsvr32.exe.7ffbc31d7404.1.unpack, type: UNPACKEDPE
Source: Yara match File source: 0.2.loaddll64.exe.7ffbc31d0000.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 3.2.regsvr32.exe.7ffbc31d0000.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 0.2.loaddll64.exe.7ffbc31d7404.1.unpack, type: UNPACKEDPE
Source: Yara match File source: 5.2.rundll32.exe.7ffbc31d7404.1.unpack, type: UNPACKEDPE
Source: Yara match File source: 5.2.rundll32.exe.7ffbc31d7404.1.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 5.2.rundll32.exe.7ffbc31d0000.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 00000005.00000002.1496761580.00007FFBC31D7000.00000004.00000001.01000000.00000003.sdmp, type: MEMORY
Source: Yara match File source: 00000003.00000002.1496317670.0000000002711000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000003.00000002.1496681049.00007FFBC31D7000.00000004.00000001.01000000.00000003.sdmp, type: MEMORY
Source: Yara match File source: 00000005.00000002.1496397137.00000186B59A1000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000006.00000002.1496870393.00007FFBC31D7000.00000004.00000001.01000000.00000003.sdmp, type: MEMORY
Source: Yara match File source: 00000000.00000002.1523579969.0000023BEAF21000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000000.00000002.1527182250.00007FFBC31D7000.00000004.00000001.01000000.00000003.sdmp, type: MEMORY
Source: Yara match File source: 00000006.00000002.1496760430.000002AB0BF31000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: Process Memory Space: loaddll64.exe PID: 2940, type: MEMORYSTR
Source: Yara match File source: Process Memory Space: regsvr32.exe PID: 3568, type: MEMORYSTR
Source: Yara match File source: Process Memory Space: rundll32.exe PID: 1868, type: MEMORYSTR
Source: Yara match File source: Process Memory Space: rundll32.exe PID: 1840, type: MEMORYSTR

Remote Access Functionality
barindex
Yara detected Strela Stealer
Source: Yara match File source: 6.2.rundll32.exe.7ffbc31d7404.1.unpack, type: UNPACKEDPE
Source: Yara match File source: 6.2.rundll32.exe.7ffbc31d0000.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 3.2.regsvr32.exe.7ffbc31d7404.1.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 0.2.loaddll64.exe.7ffbc31d7404.1.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 6.2.rundll32.exe.7ffbc31d7404.1.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 3.2.regsvr32.exe.7ffbc31d7404.1.unpack, type: UNPACKEDPE
Source: Yara match File source: 0.2.loaddll64.exe.7ffbc31d0000.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 3.2.regsvr32.exe.7ffbc31d0000.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 0.2.loaddll64.exe.7ffbc31d7404.1.unpack, type: UNPACKEDPE
Source: Yara match File source: 5.2.rundll32.exe.7ffbc31d7404.1.unpack, type: UNPACKEDPE
Source: Yara match File source: 5.2.rundll32.exe.7ffbc31d7404.1.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 5.2.rundll32.exe.7ffbc31d0000.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 00000005.00000002.1496761580.00007FFBC31D7000.00000004.00000001.01000000.00000003.sdmp, type: MEMORY
Source: Yara match File source: 00000003.00000002.1496317670.0000000002711000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000003.00000002.1496681049.00007FFBC31D7000.00000004.00000001.01000000.00000003.sdmp, type: MEMORY
Source: Yara match File source: 00000005.00000002.1496397137.00000186B59A1000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000006.00000002.1496870393.00007FFBC31D7000.00000004.00000001.01000000.00000003.sdmp, type: MEMORY
Source: Yara match File source: 00000000.00000002.1523579969.0000023BEAF21000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000000.00000002.1527182250.00007FFBC31D7000.00000004.00000001.01000000.00000003.sdmp, type: MEMORY
Source: Yara match File source: 00000006.00000002.1496760430.000002AB0BF31000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: Process Memory Space: loaddll64.exe PID: 2940, type: MEMORYSTR
Source: Yara match File source: Process Memory Space: regsvr32.exe PID: 3568, type: MEMORYSTR
Source: Yara match File source: Process Memory Space: rundll32.exe PID: 1868, type: MEMORYSTR
Source: Yara match File source: Process Memory Space: rundll32.exe PID: 1840, type: MEMORYSTR
windows-stand
Hide Legend

Legend:

  • Process
  • Signature
  • Created File
  • DNS/IP Info
  • Is Dropped
  • Is Windows Process
  • Number of created Registry Values
  • Number of created Files
  • Visual Basic
  • Delphi
  • Java
  • .Net C# or VB.NET
  • C, C++ or other language
  • Is malicious
  • Internet
behaviorgraph top1 signatures2 2 Behavior Graph ID: 1561761 Sample: yjF33u9fqZ.exe Startdate: 24/11/2024 Architecture: WINDOWS Score: 60 19 Multi AV Scanner detection for submitted file 2->19 21 Yara detected Strela Stealer 2->21 23 Machine Learning detection for sample 2->23 7 loaddll64.exe 1 2->7         started        process3 process4 9 cmd.exe 1 7->9         started        11 regsvr32.exe 7->11         started        13 rundll32.exe 7->13         started        15 conhost.exe 7->15         started        process5 17 rundll32.exe 9->17         started       
⊘No contacted IP infos