Play interactive tour

Edit tour

Analysis Report xuy1.bin

Overview

General Information

Joe Sandbox Version:	26.0.0
Analysis ID:	836034
Start date:	11.04.2019
Start time:	19:17:10
Joe Sandbox Product:	Cloud
Overall analysis duration:	0h 7m 50s
Hypervisor based Inspection enabled:	false
Report type:	full
Sample file name:	xuy1.bin (renamed file extension from bin to exe)
Cookbook file name:	default.jbs
Analysis system description:	Windows 7 (Office 2010 SP2, Java 1.8.0_40 1.8.0_191, Flash 16.0.0.305, Acrobat Reader 11.0.08, Internet Explorer 11, Chrome 55, Firefox 43)
Number of analysed new started processes analysed:	4
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies	HCA enabled EGA enabled GSI enabled (VBA) GSI enabled (Javascript) GSI enabled (Java)
Analysis stop reason:	Timeout
Detection:	MAL
Classification:	mal68.evad.winEXE@5/1@0/4
EGA Information:	Failed
HCA Information:	Successful, ratio: 100% Number of executed functions: 0 Number of non-executed functions: 0
Cookbook Comments:	Adjust boot time Enable AMSI
Warnings:	Show All Exclude process from analysis (whitelisted): dllhost.exe Report size exceeded maximum capacity and may have missing behavior information. Report size getting too big, too many NtUserCreateWindowEx calls found. Report size getting too big, too many NtUserDestroyWindow calls found. Skipping Hybrid Code Analysis (implementation is based on Java, .Net, VB or Delphi, or parses a document) for: xuy1.exe, regsvr32.exe, rundll32.exe

Detection

Strategy	Score	Range	Reporting	Whitelisted	Detection
Threshold	68	0 - 100	Report FP / FN	false

Confidence

Strategy	Score	Range	Further Analysis Required?	Confidence
Threshold	5	0 - 5	false

Classification

Analysis Advice

All HTTP servers contacted by the sample do not answer. Likely the sample is an old dropper which does no longer work

Sample drops PE files which have not been started, submit dropped PE samples for a secondary analysis to Joe Sandbox

Sample monitors Window changes (e.g. starting applications), analyze the sample with the 'Simulates keyboard and window changes' cookbook

Sample tries to load a library which is not present or installed on the analysis machine, adding the library might reveal more behavior

Uses HTTPS for network communication, use the 'Proxy HTTPS (port 443) to read its encrypted data' cookbook for further analysis

Mitre Att&ck Matrix

Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Exfiltration	Command and Control
Valid Accounts	Graphical User Interface1	Winlogon Helper DLL	Process Injection111	Software Packing1	Credential Dumping	Process Discovery1	Application Deployment Software	Data from Local System	Data Encrypted1	Standard Non-Application Layer Protocol1
Replication Through Removable Media	Service Execution	Port Monitors	Accessibility Features	Process Injection111	Network Sniffing	Security Software Discovery1	Remote Services	Data from Removable Media	Exfiltration Over Other Network Medium	Standard Application Layer Protocol1
Drive-by Compromise	Windows Management Instrumentation	Accessibility Features	Path Interception	Obfuscated Files or Information2	Input Capture	System Information Discovery1	Windows Remote Management	Data from Network Shared Drive	Automated Exfiltration	Custom Cryptographic Protocol

Signature Overview

Click to jump to signature section

AV Detection:

Antivirus or Machine Learning detection for sample

Show sources

Source: xuy1.exe

Joe Sandbox ML: detected

Antivirus or Machine Learning detection for unpacked file

Show sources

Source: 0.0.xuy1.exe.400000.0.unpack	Joe Sandbox ML: detected
Source: 0.1.xuy1.exe.400000.0.unpack	Joe Sandbox ML: detected
Source: 0.2.xuy1.exe.3ff0000.2.unpack	Joe Sandbox ML: detected

Networking:

Connects to IPs without corresponding DNS lookups

Show sources

Source: unknown	TCP traffic detected without corresponding DNS query: 215.56.245.0
Source: unknown	TCP traffic detected without corresponding DNS query: 215.56.245.0
Source: unknown	TCP traffic detected without corresponding DNS query: 215.56.245.0
Source: unknown	TCP traffic detected without corresponding DNS query: 174.60.72.9
Source: unknown	TCP traffic detected without corresponding DNS query: 174.60.72.9
Source: unknown	TCP traffic detected without corresponding DNS query: 174.60.72.9
Source: unknown	TCP traffic detected without corresponding DNS query: 87.18.28.52
Source: unknown	TCP traffic detected without corresponding DNS query: 87.18.28.52
Source: unknown	TCP traffic detected without corresponding DNS query: 87.18.28.52
Source: unknown	TCP traffic detected without corresponding DNS query: 150.132.134.24

Tries to connect to HTTP servers, but all servers are down (expired dropper behavior)

Show sources

Source: global traffic	TCP traffic: 192.168.1.81:49216 -> 215.56.245.0:443
Source: global traffic	TCP traffic: 192.168.1.81:49217 -> 174.60.72.9:443
Source: global traffic	TCP traffic: 192.168.1.81:49218 -> 87.18.28.52:443
Source: global traffic	TCP traffic: 192.168.1.81:49219 -> 150.132.134.24:443

Uses HTTPS

Show sources

Source: unknown	Network traffic detected: HTTP traffic on port 49218 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49219 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49217 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49216 -> 443

System Summary:

Blacklisted process start detected (Windows program)

Show sources

Source: C:\Windows\System32\regsvr32.exe

Process created: C:\Windows\System32\rundll32.exe C:\Windows\system32\\rundll32.exe C:\Users\user~1\Desktop\xuy1.dll,f0

PE file has nameless sections

Show sources

Source: xuy1.exe

Static PE information: section name:

PE file contains executable resources (Code or Archives)

Show sources

Source: xuy1.exe

Static PE information: Resource name: RT_STRING type: ump; DOS executable (COM)

Tries to load missing DLLs

Show sources

Source: C:\Windows\System32\regsvr32.exe

Section loaded: f1.dll

PE file has an executable .text section which is very likely to contain packed code (zlib compression ratio < 0.3)

Show sources

Source: xuy1.exe

Static PE information: Section: .text IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_READ

Classification label

Show sources

Source: classification engine

Classification label: mal68.evad.winEXE@5/1@0/4

Creates files inside the user directory

Show sources

Source: C:\Users\user\Desktop\xuy1.exe

File created: C:\Users\user\Desktop\xuy1.dll

Jump to behavior

PE file has an executable .text section and no other executable section

Show sources

Source: xuy1.exe

Static PE information: Section: .text IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_READ

Parts of this applications are using Borland Delphi (Probably coded in Delphi)

Show sources

Source: C:\Users\user\Desktop\xuy1.exe	Key opened: HKEY_CURRENT_USER\Software\Borland\Delphi\Locales	Jump to behavior
Source: C:\Users\user\Desktop\xuy1.exe	Key opened: HKEY_CURRENT_USER\Software\Borland\Delphi\Locales	Jump to behavior
Source: C:\Windows\System32\regsvr32.exe	Key opened: HKEY_CURRENT_USER\Software\Borland\Delphi\Locales
Source: C:\Windows\System32\regsvr32.exe	Key opened: HKEY_CURRENT_USER\Software\Borland\Delphi\Locales
Source: C:\Windows\System32\rundll32.exe	Key opened: HKEY_CURRENT_USER\Software\Borland\Delphi\Locales
Source: C:\Windows\System32\rundll32.exe	Key opened: HKEY_CURRENT_USER\Software\Borland\Delphi\Locales

Reads software policies

Show sources

Source: C:\Users\user\Desktop\xuy1.exe

Key opened: HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Runs a DLL by calling functions

Show sources

Source: unknown

Process created: C:\Windows\System32\rundll32.exe C:\Windows\system32\\rundll32.exe C:\Users\user~1\Desktop\xuy1.dll,f0

Spawns processes

Show sources

Source: unknown	Process created: C:\Users\user\Desktop\xuy1.exe 'C:\Users\user\Desktop\xuy1.exe'
Source: unknown	Process created: C:\Windows\System32\regsvr32.exe C:\Windows\system32\regsvr32.exe -s C:\Users\user~1\Desktop\xuy1.dll f1 C:\Users\user~1\Desktop\xuy1.exe@224
Source: unknown	Process created: C:\Windows\System32\rundll32.exe C:\Windows\system32\\rundll32.exe C:\Users\user~1\Desktop\xuy1.dll,f0
Source: C:\Users\user\Desktop\xuy1.exe	Process created: C:\Windows\System32\regsvr32.exe C:\Windows\system32\regsvr32.exe -s C:\Users\user~1\Desktop\xuy1.dll f1 C:\Users\user~1\Desktop\xuy1.exe@224	Jump to behavior
Source: C:\Windows\System32\regsvr32.exe	Process created: C:\Windows\System32\rundll32.exe C:\Windows\system32\\rundll32.exe C:\Users\user~1\Desktop\xuy1.dll,f0

Data Obfuscation:

PE file contains sections with non-standard names

Show sources

Source: xuy1.exe	Static PE information: section name: .newIT
Source: xuy1.exe	Static PE information: section name:
Source: xuy1.dll.0.dr	Static PE information: section name: .didata

Registers a DLL

Show sources

Source: unknown

Process created: C:\Windows\System32\regsvr32.exe C:\Windows\system32\regsvr32.exe -s C:\Users\user~1\Desktop\xuy1.dll f1 C:\Users\user~1\Desktop\xuy1.exe@224

Binary may include packed or encrypted code

Show sources

Source: initial sample

Static PE information: section name: .text entropy: 7.29911063566

Persistence and Installation Behavior:

Drops PE files

Show sources

Source: C:\Users\user\Desktop\xuy1.exe

File created: C:\Users\user\Desktop\xuy1.dll

Jump to dropped file

Hooking and other Techniques for Hiding and Protection:

Disables application error messsages (SetErrorMode)

Show sources

Source: C:\Users\user\Desktop\xuy1.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\xuy1.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\regsvr32.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\regsvr32.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\regsvr32.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\regsvr32.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\regsvr32.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\rundll32.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\rundll32.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\rundll32.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\rundll32.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\rundll32.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\rundll32.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\rundll32.exe	Process information set: NOOPENFILEERRORBOX

Malware Analysis System Evasion:

Checks the free space of harddrives

Show sources

Source: C:\Windows\System32\regsvr32.exe	File Volume queried: C:\ FullSizeInformation
Source: C:\Windows\System32\rundll32.exe	File Volume queried: C:\ FullSizeInformation

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

Show sources

Source: C:\Users\user\Desktop\xuy1.exe	Window / User API: threadDelayed 420			Jump to behavior
Source: C:\Users\user\Desktop\xuy1.exe	Window / User API: threadDelayed 420			Jump to behavior

Found dropped PE file which has not been started or loaded

Show sources

Source: C:\Users\user\Desktop\xuy1.exe

Dropped PE file which has not been started: C:\Users\user\Desktop\xuy1.dll

Jump to dropped file

May sleep (evasive loops) to hinder dynamic analysis

Show sources

Source: C:\Users\user\Desktop\xuy1.exe TID: 2712	Thread sleep count: 420 > 30			Jump to behavior
Source: C:\Users\user\Desktop\xuy1.exe TID: 2588	Thread sleep count: 420 > 30			Jump to behavior

Queries a list of all running processes

Show sources

Source: C:\Windows\System32\regsvr32.exe

Process information queried: ProcessInformation

Anti Debugging:

Checks for kernel debuggers (NtQuerySystemInformation(SystemKernelDebuggerInformation))

Show sources

Source: C:\Users\user\Desktop\xuy1.exe

System information queried: KernelDebuggerInformation

HIPS / PFW / Operating System Protection Evasion:

System process connects to network (likely due to code injection or exploit)

Show sources

Source: C:\Windows\System32\rundll32.exe	Network Connect: 87.18.28.52 443
Source: C:\Windows\System32\rundll32.exe	Network Connect: 150.132.134.24 443
Source: C:\Windows\System32\rundll32.exe	Network Connect: 215.56.245.0 443
Source: C:\Windows\System32\rundll32.exe	Network Connect: 174.60.72.9 443

Creates a process in suspended mode (likely to inject code)

Show sources

Source: C:\Users\user\Desktop\xuy1.exe	Process created: C:\Windows\System32\regsvr32.exe C:\Windows\system32\regsvr32.exe -s C:\Users\user~1\Desktop\xuy1.dll f1 C:\Users\user~1\Desktop\xuy1.exe@224			Jump to behavior
Source: C:\Windows\System32\regsvr32.exe	Process created: C:\Windows\System32\rundll32.exe C:\Windows\system32\\rundll32.exe C:\Users\user~1\Desktop\xuy1.dll,f0

May try to detect the Windows Explorer process (often used for injection)

Show sources

Source: rundll32.exe, 00000003.00000002.1645767935.00600000.00000002.sdmp	Binary or memory string: Program Manager
Source: rundll32.exe, 00000003.00000002.1645767935.00600000.00000002.sdmp	Binary or memory string: Progman
Source: rundll32.exe, 00000003.00000002.1645767935.00600000.00000002.sdmp	Binary or memory string: Shell_TrayWnd

Language, Device and Operating System Detection:

Queries the volume information (name, serial number etc) of a device

Show sources

Source: C:\Windows\System32\regsvr32.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Windows\System32\rundll32.exe	Queries volume information: C:\ VolumeInformation

Queries the cryptographic machine GUID

Show sources

Source: C:\Users\user\Desktop\xuy1.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Simulations

Behavior and APIs

Time	Type	Description
19:18:14	API Interceptor	498x Sleep call for process: xuy1.exe modified
19:18:14	API Interceptor	1x Sleep call for process: regsvr32.exe modified
19:18:15	API Interceptor	1x Sleep call for process: rundll32.exe modified

Antivirus and Machine Learning Detection

Initial Sample

Source	Detection	Scanner	Label	Link
xuy1.exe	100%	Joe Sandbox ML

Dropped Files

No Antivirus matches

Unpacked PE Files

Source	Detection	Scanner	Download
0.0.xuy1.exe.400000.0.unpack	100%	Joe Sandbox ML	Download File
0.1.xuy1.exe.400000.0.unpack	100%	Joe Sandbox ML	Download File
0.2.xuy1.exe.3ff0000.2.unpack	100%	Joe Sandbox ML	Download File

Domains

No Antivirus matches

URLs

No Antivirus matches

Yara Overview

Initial Sample

No yara matches

PCAP (Network Traffic)

No yara matches

Dropped Files

No yara matches

Memory Dumps

No yara matches

Unpacked PEs

No yara matches

Screenshots

Thumbnails

This section contains all screenshots as thumbnails, including those not shown in the slideshow.

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading ...

Warning!

Analysis Report xuy1.bin

Overview

General Information

Detection

Confidence

Classification

Analysis Advice

Mitre Att&ck Matrix

Signature Overview

AV Detection:

Networking:

System Summary:

Data Obfuscation:

Persistence and Installation Behavior:

Hooking and other Techniques for Hiding and Protection:

Malware Analysis System Evasion:

Anti Debugging:

HIPS / PFW / Operating System Protection Evasion:

Language, Device and Operating System Detection:

Behavior Graph

Simulations

Behavior and APIs

Antivirus and Machine Learning Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Yara Overview

Initial Sample

PCAP (Network Traffic)

Dropped Files

Memory Dumps

Unpacked PEs

Screenshots

Thumbnails