ID: Sample Name: Renci.SshNet.dll Cookbook: default.jbs Time: 12:55:23 Date: 08/06/2018 Version:

Transcription

1 ID: Sample Name: Renci.SshNet.dll Cookbook: default.jbs Time: 12:55:23 Date: 0/06/201 Version:

2 Table of Contents Table of Contents Analysis Report Overview General Information Detection Confidence Classification Analysis Advice Signature Overview System Summary: Anti Debugging: Malware Analysis System Evasion: Behavior Graph Simulations Behavior and APIs Antivirus Detection Initial Sample Dropped Files Unpacked PE Files Domains URLs Yara Overview Initial Sample PCAP (Network Traffic) Dropped Files Memory Dumps Unpacked PEs Joe Sandbox View / Context IPs Domains ASN Dropped Files Screenshots Startup Created / dropped Files Contacted Domains/Contacted IPs Contacted Domains Contacted IPs Static File Info General File Icon Static PE Info General Entrypoint Preview Data Directories Sections Resources Imports Version Infos Network Behavior Code Manipulations Statistics Copyright Joe Security LLC 201 Page 2 of 14

3 System Behavior Analysis Process: loaddll32.exe PID: 392 Parent PID: 3412 General File Activities File Written Disassembly Code Analysis Copyright Joe Security LLC 201 Page 3 of 14

4 Analysis Report Overview General Information Joe Sandbox Version: Analysis ID: Start time: 12:55:23 Joe Sandbox Product: CloudBasic Start date: Overall analysis duration: Hypervisor based Inspection enabled: Report type: Sample file name: Cookbook file name: 0h 1m 22s false light Renci.SshNet.dll default.jbs Analysis system description: Windows 7 SP1 (with Office 20 SP2, IE 11, FF 54, Chrome 60, Acrobat Reader DC 17, Flash 26, Java ) Number of analysed new started processes analysed: 2 Number of new started drivers analysed: 0 Number of existing processes analysed: 0 Number of existing drivers analysed: 0 Number of injected processes analysed: 0 Technologies Analysis stop reason: Detection: Classification: HCA enabled EGA enabled HDC enabled Timeout CLEAN clean0.windll@1/1@0/0 HCA Information: Successful, ratio: 0% Number of executed functions: 0 Number of non-executed functions: 0 EGA Information: HDC Information: Cookbook Comments: Warnings: Failed Failed Adjust boot time Correcting counters for adjusted boot time Found application associated with file extension:.dll Stop behavior analysis, all processes terminated Show All Exclude process from analysis (whitelisted): dllhost.exe Skipping Hybrid Code Analysis (implementation is based on Java,.Net, VB or Delphi, or parses a document) for: loaddll32.exe Detection Strategy Score Range Reporting Detection Threshold Report FP / FN Confidence Copyright Joe Security LLC 201 Page 4 of 14

5 Strategy Score Range Further Analysis Required? Threshold false Confidence Classification Ransomware Miner Spreading malicious malicious malicious Evader Phishing suspicious suspicious suspicious clean clean clean Exploiter Banker Spyware Trojan / Bot Adware Analysis Advice Sample is a C# Dll, sample needs to be analyzed in a.net context Copyright Joe Security LLC 201 Page 5 of 14

6 Signature Overview System Summary Anti Debugging Malware Analysis System Evasion Click to jump to signature section System Summary:.NET source code contains methods with suspicious names Classification label PE file has an executable.text section and no other executable section Reads software policies PE file contains a COM descriptor data directory Contains modern PE file flags such as dynamic base (ASLR) or NX PE file contains a debug data directory Binary contains paths to debug symbols Anti Debugging: Program does not show much activity (idle) Malware Analysis System Evasion: Program does not show much activity (idle) Behavior Graph Copyright Joe Security LLC 201 Page 6 of 14

7 Hide Legend ID: Behavior Graph Legend: Process Signature Created File DNS/IP Info Is Dropped Is Windows Process Number of created Registry Values Number of created Files Sample: Renci.SshNet.dll Startdate: 0/06/201 Architecture: WINDOWS Score: 0 Visual Basic Delphi Java.Net C# or VB.NET C, C++ or other language Is malicious started loaddll32.exe Simulations Behavior and APIs Time Type Description 12:55:26 API Interceptor 1x Sleep call for process: loaddll32.exe modified Antivirus Detection Initial Sample Source Detection Scanner Label Link Renci.SshNet.dll 0% virustotal Browse Renci.SshNet.dll 0% metadefender Browse Dropped Files No Antivirus matches Unpacked PE Files No Antivirus matches Domains No Antivirus matches Copyright Joe Security LLC 201 Page 7 of 14

8 URLs No Antivirus matches Yara Overview Initial Sample No yara matches PCAP (Network Traffic) No yara matches Dropped Files No yara matches Memory Dumps No yara matches Unpacked PEs No yara matches Joe Sandbox View / Context IPs No context Domains No context ASN No context Dropped Files No context Screenshots Copyright Joe Security LLC 201 Page of 14

9 Startup System is w7 cleanup loaddll32.exe (PID: 392 cmdline: loaddll32.exe 'C:\Users\user\Desktop\Renci.SshNet.dll' MD5: D2792A55032CFE25F07DCD4BEC5F40F) Created / dropped Files stdout Process: File Type: Size (bytes): 90 C:\Windows\System32\loaddll32.exe ASCII text, with CRLF line terminators Entropy (bit): Encrypted: MD5: SHA1: SHA-256: SHA-512: Malicious: Reputation: false 63CEAD37596E635AC39DAF5AB0 34CB7B4C092560B14726E D50A6DA9 2C0190B622CD64E7CD1B50A6627E21F974EF52977C39AE3272ED60 6CFB52FFD74919F6B9439D79F4366BA217DD4370FC247F5965A933E2E35C0A9EEE9121DB0E06A2F5BA9437 F9659F9AFB2D2B0DFFF1B42F7A44CF16C2 false low Copyright Joe Security LLC 201 Page 9 of 14

10 Contacted Domains/Contacted IPs Contacted Domains No contacted domains info Contacted IPs No contacted IP infos Static File Info General File type: Entropy (bit): PE32 executable (DLL) (console) Intel 036 Mono/.Net assembly, for MS Windows TrID: Win32 Dynamic Link Library (generic) (02004/3) 97.74% Windows Screen Saver (4/52) 1.2% Visual Basic Script (6000/0) 0.59% Generic Win/DOS Executable (2004/3) 0.20% DOS Executable Generic (2002/1) 0.20% File name: File size: MD5: SHA1: SHA256: SHA512: File Content Preview: Renci.SshNet.dll 2fd9f99d4994d42ebf93e9eb02ded6 04fa05aad24cd5a156454ae21e05fc9433 f6315ed14643f ffe9690ed39a2abc9a a3a27a b5f551b9dc4a2f4b1b00e6154fd79da44751b164 b6930fc9de1d1a4161e9b05ab69c46bb7fecf7e670 db459964d6d4ab0a1b7226e2cedfc7 is program cannot be run in DOS File Icon Static PE Info General Entrypoint: 0x062ade Entrypoint Section:.text Digitally signed: false Imagebase: 0x Subsystem: windows cui Image File Characteristics: EXECUTABLE_IMAGE, DLL, LARGE_ADDRESS_AWARE DLL Characteristics: NO_SEH, TERMINAL_SERVER_AWARE, DYNAMIC_BASE, NX_COMPAT Time Stamp: 0x59E5000B [Mon Oct 16 1:52: UTC] TLS Callbacks: CLR (.Net) Version: v OS Version Major: 4 OS Version Minor: 0 File Version Major: 4 File Version Minor: 0 Subsystem Version Major: 4 Subsystem Version Minor: 0 Import Hash: dae02f32a21e03ce65412f6e56942daa Entrypoint Preview Copyright Joe Security LLC 201 Page of 14

11 Instruction jmp dword ptr [002000h] add byte ptr [ecx+eax], al add byte ptr [esp+eax], al add dword ptr [ecx], eax add dword ptr [ecx], eax add al, 04h add byte ptr [eax+eax], al add al, 01h add dword ptr [esp+eax], eax add dword ptr [ecx], eax add byte ptr [eax+eax], al add byte ptr [esp+eax], al add dword ptr [ecx], eax add al, 04h add byte ptr [eax+eax], al add al, 01h add al, 01h add dword ptr [esp+eax], eax add al, 04h add al, 04h add al, 04h Copyright Joe Security LLC 201 Page 11 of 14

12 Instruction add dword ptr [ecx], eax add dword ptr [ecx], eax add byte ptr [ecx+eax], al add byte ptr [eax+eax], al add dword ptr [ecx], eax add byte ptr [ecx+eax], al add byte ptr [eax+eax], al add byte ptr [eax+eax], al add byte ptr [eax+eax], al Data Directories Name Virtual Address Virtual Size Is in Section IMAGE_DIRECTORY_ENTRY_EXPORT 0x0 0x0 IMAGE_DIRECTORY_ENTRY_IMPORT 0x62ac 0x4f.text IMAGE_DIRECTORY_ENTRY_RESOURCE 0x6a000 0x45.rsrc IMAGE_DIRECTORY_ENTRY_EXCEPTION 0x0 0x0 IMAGE_DIRECTORY_ENTRY_SECURITY 0x0 0x0 IMAGE_DIRECTORY_ENTRY_BASERELOC 0x6c000 0xc.reloc IMAGE_DIRECTORY_ENTRY_DEBUG 0x x1c.text IMAGE_DIRECTORY_ENTRY_COPYRIGHT 0x0 0x0 IMAGE_DIRECTORY_ENTRY_GLOBALPTR 0x0 0x0 IMAGE_DIRECTORY_ENTRY_TLS 0x0 0x0 IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG 0x0 0x0 IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT 0x0 0x0 IMAGE_DIRECTORY_ENTRY_IAT 0x2000 0x.text IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT 0x0 0x0 IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR 0x200 0x4.text IMAGE_DIRECTORY_ENTRY_RESERVED 0x0 0x0 Sections Name Virtual Address Virtual Size Raw Size Xored PE ZLIB Complexity File Type Entropy Characteristics.text 0x2000 0x669f4 0x66a00 False data IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_READ.rsrc 0x6a000 0x45 0x600 False data IMAGE_SCN_CNT_INITIALIZED _DATA, IMAGE_SCN_MEM_READ.reloc 0x6c000 0xc 0x200 False dbase IV DBT of \340:.DBF, blocks size 12, next free block index IMAGE_SCN_CNT_INITIALIZED _DATA, IMAGE_SCN_MEM_DISCARDA BLE, IMAGE_SCN_MEM_READ Resources Name RVA Size Type Language Country RT_VERSION 0x6a05 0x3fa data Imports DLL mscoree.dll Import _CorDllMain Version Infos Copyright Joe Security LLC 201 Page 12 of 14

13 Description Data Translation 0x0000 0x04b0 LegalCopyright Copyright Renci Assembly Version InternalName Renci.SshNet.dll FileVersion CompanyName Renci LegalTrademarks Comments SSH.NET is a Secure Shell (SSH) library for.net, optimized for parallelism. ProductName SSH.NET ProductVersion FileDescription SSH.NET.NET 4.0 OriginalFilename Renci.SshNet.dll Network Behavior No network behavior found Code Manipulations Statistics System Behavior Analysis Process: loaddll32.exe PID: 392 Parent PID: 3412 General Start time: 12:55:26 Start date: 0/06/201 Path: Wow64 process (32bit): Commandline: Imagebase: File size: MD5 hash: Has administrator privileges: Programmed in: Reputation: C:\Windows\System32\loaddll32.exe false loaddll32.exe 'C:\Users\user\Desktop\Renci.SshNet.dll' 0x bytes D2792A55032CFE25F07DCD4BEC5F40F true C, C++ or other language moderate File Activities File Written File Path Offset Length Value Ascii Completion Count Source Address Symbol Copyright Joe Security LLC 201 Page of 14

14 File Path Offset Length Value Ascii Completion Count Source Address Symbol stdout unknown 90 4e 6f f 72 No export dir found for f C:\Use 75 6e f rs\user\desktop\renci.ssh success or wait 1 125A7D2 WriteFile 43 3a 5c Net.dll..Plain dll loading c d c 6c 5c b 74 6f 70 5c e e e e 64 6c 6c 0d 0a 50 6c e c 6c 20 6c 6f e 67 0d 0a Disassembly Code Analysis Copyright Joe Security LLC 201 Page 14 of 14