ID: Sample Name: REWjcrauz7 Cookbook: default.jbs Time: 12:14:00 Date: 29/09/2017 Version:

Transcription

1 ID: Sample Name: REWjcrauz7 Cookbook: default.jbs Time: 12:14:00 Date: 29/09/2017 Version:

2 Table of Contents Table of Contents Analysis Report Overview Information Detection Confidence Classification Signature Overview AV Detection: System Summary: Anti Debugging: Malware Analysis System Evasion: Hooking and other Techniques for Hiding and Protection: Behavior Graph Simulations Behavior and APIs Antivirus Detection Initial Sample Dropped Files Domains Yara Overview Initial Sample PCAP (Network Traffic) Dropped Files Memory Dumps Joe Sandbox View / Context IPs Domains ASN Dropped Files Screenshot Startup Created / dropped Files Contacted Domains/Contacted IPs Contacted Domains Contacted IPs Static File Info File Icon Static PE Info Entrypoint Preview Data Directories Sections Resources Imports Possible Origin Network Behavior Code Manipulations Statistics Behavior System Behavior Analysis Process: loaddll32.exe PID: 3236 Parent PID: 2964 Copyright Joe Security LLC 2017 Page 2 of

3 File Activities File Written Analysis Process: rundll32.exe PID: 326 Parent PID: 3236 Analysis Process: rundll32.exe PID: 320 Parent PID: 3236 Disassembly Code Analysis Copyright Joe Security LLC 2017 Page 3 of 15

4 Analysis Report Overview Information Joe Sandbox Version: Analysis ID: Start time: 12:14:00 Joe Sandbox Product: CloudBasic Start date: Overall analysis duration: Hypervisor based Inspection enabled: Report type: Sample file name: Cookbook file name: 0h 1m 17s false light REWjcrauz7 (renamed file extension from none to dll) default.jbs Analysis system description: Windows 7 SP1 (with Office 2010 SP2, IE 11, FF 54, Chrome 60, Acrobat Reader DC 17, Flash 26, Java ) Number of analysed new started processes analysed: 5 Number of new started drivers analysed: 0 Number of existing processes analysed: 0 Number of existing drivers analysed: 0 Number of injected processes analysed: 0 Technologies Detection: Classification: MAL HCA enabled EGA enabled HDC enabled AIS enabled mal52.windll@5/1@0/0 HCA Information: Successful, ratio: 100% Number of executed functions: 0 Number of non-executed functions: 0 EGA Information: HDC Information: Cookbook Comments: Warnings: Failed Failed Stop behavior analysis, all processes terminated Show All Exclude process from analysis (whitelisted): WMIADAP.exe, dllhost.exe Detection Strategy Score Range Reporting Detection Threshold Report FP / FN Confidence Strategy Score Range Further Analysis Required? Confidence Copyright Joe Security LLC 2017 Page 4 of 15

5 Strategy Score Range Further Analysis Required? Threshold false Confidence Classification Ransomware Evader Spreading malicious malicious malicious suspicious suspicious suspicious Exploiter Phishing clean clean clean Spyware Banker Adware Trojan / Bot Signature Overview Copyright Joe Security LLC 2017 Page 5 of 15

6 AV Detection System Summary Anti Debugging Malware Analysis System Evasion Hooking and other Techniques for Hiding and Protection Click to jump to signature section AV Detection: Antivirus detection for submitted file System Summary: Classification label PE file has an executable.text section and no other executable section Reads software policies Runs a DLL by calling functions Sample is known by Antivirus (Virustotal or Metascan) Spawns processes PE file contains executable resources (Code or Archives) Anti Debugging: Program does not show much activity (idle) Malware Analysis System Evasion: Contains long sleeps (>= 3 min) May sleep (evasive loops) to hinder dynamic analysis Program does not show much activity (idle) Hooking and other Techniques for Hiding and Protection: May modify the system service descriptor table (often done to hook functions) Behavior Graph Copyright Joe Security LLC 2017 Page 6 of 15

7 ID: Behavior Graph Legend: Process Signature Created File DNS/IP Info Is Dropped Sample: REWjcrauz7 Startdate: 29/09/2017 Architecture: WINDOWS Score: 52 Is Windows Process Number of created Registry Values Number of created Files Visual Basic Delphi started Java.Net C# or VB.NET loaddll32.exe C, C++ or other language Is malicious started started rundll32.exe rundll32.exe Simulations Behavior and APIs No simulations Antivirus Detection Initial Sample Source Detection Cloud Link REWjcrauz7.dll 95% virustotal Browse REWjcrauz7.dll 5% metadefender Browse Dropped Files No Antivirus matches Domains No Antivirus matches Copyright Joe Security LLC 2017 Page 7 of 15

8 Yara Overview Initial Sample No yara matches PCAP (Network Traffic) No yara matches Dropped Files No yara matches Memory Dumps No yara matches Joe Sandbox View / Context IPs No context Domains No context ASN No context Dropped Files No context Screenshot Copyright Joe Security LLC 2017 Page of 15

9 Startup system is w7 loaddll32.exe (PID: 3236 cmdline: loaddll32.exe 'C:\Users\user\Desktop\REWjcrauz7.dll' MD5: D2792A55032CFE25F07DCD4BEC5F40F) rundll32.exe (PID: 326 cmdline: rundll32.exe C:\Users\user\Desktop\REWjcrauz7.dll,#1 MD5: C E275CF2AD04B67A6CE2) rundll32.exe (PID: 320 cmdline: rundll32.exe C:\Users\user\Desktop\REWjcrauz7.dll,#2 MD5: C E275CF2AD04B67A6CE2) cleanup Created / dropped Files unknown File Type: ASCII text, with CRLF line terminators MD5: F56EF61B14BFFF570F2314B0DF19 SHA1: 00CF13F67A996927ABCBBD457240FA72B422 SHA-256: 6EEABB56322E7A A420E11C32F03627B5C6BD2FF509AA270ED2B6D SHA-512: EC9B4BCC7A9A3D55AE169C4C65ECA5FA5B2421A7FC2FDFF19DA931BFEF7D069DF9D7CFEE16375F270E719C07A173 F0F27E0E5729DF0C06F7532B7493 Malicious: false Contacted Domains/Contacted IPs Contacted Domains Copyright Joe Security LLC 2017 Page 9 of 15

10 No contacted domains info Contacted IPs No contacted IP infos Static File Info File type: PE32 executable (DLL) (GUI) Intel 036, for MS Wi ndows TrID: Win32 Dynamic Link Library (generic) ( /3) 99.60% Generic Win/DOS Executable (2004/3) 0.20% DOS Executable Generic (2002/1) 0.20% Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00% File name: File size: MD5: SHA1: SHA256: SHA512: File Content Preview: REWjcrauz7.dll 4c31fe56ff4a46fbcd7b c2513ebf75ac6ad4cab36b537f f405 bcbdf3ecee6fd5a7e63a36c37d3e9c5acc052b51f7ba7 3307dc9bc6f0d9df6 540af6ce6b49bae3a36769e439465d344646d50ad 1d547afda efa1037d3e20db922ffbe ca67d75b0dcca7d431faf1bd is program cannot be run in DOS mode...$...w.y. w.y.w.y.k.y.w.yfk.y.w.y.t.y.w.y.x.y.w.y.w.ynw.y.h.y.w.y.t.y.w.y.q.y.w.y-h.y.w.y-h.y.w.y}q.y.w.y-h.y.w.y Rich.w.Y... File Icon Static PE Info Entrypoint: Entrypoint Section: Digitally signed: Imagebase: Subsystem: Image File Characteristics: DLL Characteristics: Time Stamp: TLS Callbacks: CLR (.Net) Version: OS Version Major: 4 OS Version Minor: 0 File Version Major: 4 File Version Minor: 0 Subsystem Version Major: 4 Subsystem Version Minor: 0 Import Hash: 0x1000d41b.text false 0x windows gui LOCAL_SYMS_STRIPPED, 32BIT_MACHINE, EXECUTABLE_IMAGE, DLL, LINE_NUMS_STRIPPED 0x4D7F37 [Mon Jul 2 0:11: UTC] 1f5e76572fad ca3571f53 Entrypoint Preview Instruction push ebp mov ebp, esp push ebx mov ebx, dword ptr [ebp+0h] Copyright Joe Security LLC 2017 Page 10 of 15

11 Instruction push esi mov esi, dword ptr [ebp+0ch] push edi mov edi, dword ptr [ebp+10h] test esi, esi jne 00007FABEECC91Bh cmp dword ptr [ h], h jmp 00007FABEECC93h cmp esi, 01h je 00007FABEECC917h cmp esi, 02h jne 00007FABEECC934h mov eax, dword ptr [100106h] test eax, eax je 00007FABEECC91Bh push edi push esi push ebx call eax test eax, eax je 00007FABEECC91Eh push edi push esi push ebx call 00007FABEECC2Ah test eax, eax jne 00007FABEECC916h xor eax, eax jmp 00007FABEECC960h push edi push esi push ebx call 00007FABEEC15B3h cmp esi, 01h mov dword ptr [ebp+0ch], eax jne 00007FABEECC91Eh test eax, eax jne 00007FABEECC949h push edi push eax push ebx call 00007FABEECC06h test esi, esi je 00007FABEECC917h cmp esi, 03h jne 00007FABEECC93h push edi push esi push ebx call 00007FABEECC7F5h test eax, eax jne 00007FABEECC915h and dword ptr [ebp+0ch], eax cmp dword ptr [ebp+0ch], h je 00007FABEECC923h mov eax, dword ptr [100106h] test eax, eax je 00007FABEECC91Ah push edi push esi push ebx call eax mov dword ptr [ebp+0ch], eax mov eax, dword ptr [ebp+0ch] Copyright Joe Security LLC 2017 Page 11 of 15

12 Instruction pop edi pop esi pop ebx pop ebp retn 000Ch jmp dword ptr [1000E1D0h] jmp dword ptr [1000E1Dh] jmp dword ptr [1000E1E0h] jmp dword ptr [1000E1ECh] jmp dword ptr [1000E1F0h] jmp dword ptr [1000E10h] Data Directories Name Virtual Address Virtual Size Is in Section IMAGE_DIRECTORY_ENTRY_EXPORT 0xfb70 0x42.rdata IMAGE_DIRECTORY_ENTRY_IMPORT 0xf04 0x7.rdata IMAGE_DIRECTORY_ENTRY_RESOURCE 0x x1a73.rsrc IMAGE_DIRECTORY_ENTRY_EXCEPTION 0x0 0x0 IMAGE_DIRECTORY_ENTRY_SECURITY 0x0 0x0 IMAGE_DIRECTORY_ENTRY_BASERELOC 0x2c000 0x990.reloc IMAGE_DIRECTORY_ENTRY_DEBUG 0x0 0x0 IMAGE_DIRECTORY_ENTRY_COPYRIGHT 0x0 0x0 IMAGE_DIRECTORY_ENTRY_GLOBALPTR 0x0 0x0 IMAGE_DIRECTORY_ENTRY_TLS 0x0 0x0 IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG 0x0 0x0 IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT 0x0 0x0 IMAGE_DIRECTORY_ENTRY_IAT 0xe000 0x220.rdata IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT 0x0 0x0 IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR 0x0 0x0 IMAGE_DIRECTORY_ENTRY_RESERVED 0x0 0x0 Sections Name Virtual Address Virtual Size Raw Size Entropy Xored PE ZLIB Complexity File Type Characteristics.text 0x1000 0xc5b5 0xd000 False data IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_READ.rdata 0xe000 0x1bb2 0x2000 False data IMAGE_SCN_CNT_INITIALIZED_D ATA, IMAGE_SCN_MEM_READ.data 0x x6c 0x1000 False data IMAGE_SCN_CNT_INITIALIZED_D ATA, IMAGE_SCN_MEM_WRITE, IMAGE_SCN_MEM_READ.rsrc 0x x1a73 0x1b000 False data IMAGE_SCN_CNT_INITIALIZED_D ATA, IMAGE_SCN_MEM_READ.reloc 0x2c000 0xdc0 0x1000 False data IMAGE_SCN_CNT_INITIALIZED_D ATA, IMAGE_SCN_MEM_DISCARDABL E, IMAGE_SCN_MEM_READ Resources Name RVA Size Type Language Country BINARY 0x110f 0x62c Non-ISO extended-ascii text, with very long lines, with no line terminators BINARY 0x x1 very short file (no magic) English United States BINARY 0x1172 0x1a000 PE32 executable (console) Intel 036, for MS Windows BINARY 0x2b72 0x1 very short file (no magic) English United States BINARY 0x2b72c 0xb ASCII text, with no line terminators English United States Imports DLL WS2_32.dll Import htonl Copyright Joe Security LLC 2017 Page 12 of 15

13 DLL KERNEL32.dll USER32.dll ADVAPI32.dll MSVCRT.dll Import FindClose, FindFirstFileA, GetVolumeInformationA, WaitForSingleObject, CreateMutexA, OpenMutexA, ReadFile, FindNextFileA, FreeLibrary, GetTempPathA, GetSystemDirectoryA, GetSystemTime, lstrlena, lstrcpyna, GetComputerNameA, OpenProcess, GetVersionExA, GetModuleFileNameA, LocalFree, LocalAlloc, GetCurrentProcess, GetCurrentThread, CreateMutexW, SetLastError, lstrcpya, GetVersion, lstrcata, VirtualFree, ReleaseMutex, VirtualAlloc, OpenMutexW, GetModuleHandleA, LoadLibraryExA, IsBadReadPtr, CreateFileW, GetEnvironmentVariableW, LoadLibraryW, MapViewOfFile, CreateFileMappingA, LoadLibraryA, SetFilePointer, GetProcAddress, CreateThread, Sleep, CreateFileA, WriteFile, CloseHandle, GetFileTime, SetFileTime, CreateProcessA, BeginUpdateResourceA, UpdateResourceA, EndUpdateResourceA, FindResourceA, LoadResource, SizeofResource, LockResource, DeleteFileA, GetLastError, CopyFileA, SetFileAttributesA, GetEnvironmentVariableA, GetCurrentProcessId, GetFileSize UnregisterClassA, SetPropA, CreateWindowExW, DestroyWindow, wsprintfa, UnregisterClassW RegDeleteValueA, RegEnumValueA, LookupAccountNameA, RegEnumKeyExA, LookupAccountSidA, IsValidSid, AccessCheck, OpenProcessToken, GetTokenInformation, GetSidSubAuthorityCount, GetSidSubAuthority, GetUserNameW, LookupAccountSidW, AllocateAndInitializeSid, FreeSid, RegOpenKeyExA, RegQueryValueExA, RegCreateKeyExA, RegCloseKey, RegSetValueExA, SetSecurityDescriptorGroup, SetSecurityDescriptorOwner, InitializeSecurityDescriptor, AddAccessAllowedAce, InitializeAcl, DuplicateTokenEx, OpenThreadToken, GetSidIdentifierAuthority, SetSecurityDescriptorDacl _mbschr, _local_unwind2, strcmp, wcsncat, wcscpy, strncmp, _wcsicmp, _adjust_fdiv, _itoa, _stricmp, sscanf, strcat, memset, strstr, strncpy, memcpy, strlen, malloc, strcpy, free, strncat, memcmp, _snprintf, _ftol, realloc, _abnormal_termination, wcscmp, _initterm Possible Origin Language of compilation system Country where language is spoken Map English United States Network Behavior No network behavior found Code Manipulations Statistics Behavior loaddll32.exe rundll32.exe rundll32.exe Click to jump to process Copyright Joe Security LLC 2017 Page 13 of 15

14 System Behavior Analysis Process: loaddll32.exe PID: 3236 Parent PID: 2964 Start time: 12:14:57 Start date: 29/09/2017 Path: Wow64 process (32bit): Commandline: Imagebase: File size: MD5 hash: Programmed in: C:\Windows\System32\loaddll32.exe false loaddll32.exe 'C:\Users\user\Desktop\REWjcrauz7.dll' 0x bytes D2792A55032CFE25F07DCD4BEC5F40F C, C++ or other language File Activities File Written File Path Offset Length Value Ascii Completion Count unknown unknown f 75 6e 64 3a Found: 2 exports, f calling..call exports 2c c 6c Successfully called cmd 6e 67 0d 0a c line rundll32.exe C:\Us 6c f ers\user\desktop\rewjcra d 0a uz7.dll,#1..successfully called cmd line 6c 6c c 6c rundll32.exe C:\Users\use d r\desktop\rewjcrauz7.dll, 6c 69 6e #2.. 6e 64 6c 6c e a 5c c 41 6e 6e f 6c e 5c b 74 6f 70 5c a a 37 2e 64 6c 6c 2c d 0a c 6c c 6c d c 69 6e e 64 6c 6c e a 5c c 41 6e 6e f 6c e 5c b 74 6f 70 5c a a 37 2e 64 6c 6c 2c d 0a Source Address Symbol success or wait 1 30A7D2 WriteFile Analysis Process: rundll32.exe PID: 326 Parent PID: 3236 Start time: 12:14:57 Start date: 29/09/2017 Path: Wow64 process (32bit): Commandline: Imagebase: File size: MD5 hash: Programmed in: C:\Windows\System32\rundll32.exe false rundll32.exe C:\Users\user\Desktop\REWjcrauz7.dll,#1 0x76e bytes C E275CF2AD04B67A6CE2 C, C++ or other language Copyright Joe Security LLC 2017 Page 14 of 15

15 Analysis Process: rundll32.exe PID: 320 Parent PID: 3236 Start time: 12:15:00 Start date: 29/09/2017 Path: Wow64 process (32bit): Commandline: Imagebase: File size: MD5 hash: Programmed in: C:\Windows\System32\rundll32.exe false rundll32.exe C:\Users\user\Desktop\REWjcrauz7.dll,#2 0x76e bytes C E275CF2AD04B67A6CE2 C, C++ or other language Disassembly Code Analysis Copyright Joe Security LLC 2017 Page 15 of 15