ID: Sample Name: Trojan- Banker.Win32.Generic_002.malware Cookbook: default.jbs Time: 14:04:33 Date: 17/01/2018 Version: 20.0.

Transcription

1 ID: 4299 Sample Name: Trojan- Banker.Win32.Generic_002.malware Cookbook: default.jbs Time: 14:04:33 Date: 17/01/201 Version:

2 Table of Contents Analysis Report Overview Information Detection Confidence Classification Signature Overview AV Detection: Networking: Data Obfuscation: System Summary: Anti Debugging: Malware Analysis System Evasion: Behavior Graph Simulations Behavior and APIs Antivirus Detection Initial Sample Dropped Files Domains Yara Overview Initial Sample PCAP (Network Traffic) Dropped Files Memory Dumps Unpacked PEs Joe Sandbox View / Context IPs Domains ASN Dropped Files Screenshot Startup Created / dropped Files Contacted Domains/Contacted IPs Contacted Domains Contacted IPs Static File Info File Icon Static PE Info Entrypoint Preview Data Directories Sections Imports Exports Network Behavior Code Manipulations Statistics Behavior System Behavior Table of Contents Copyright Joe Security LLC 201 Page 2 of

3 Analysis Process: loaddll32.exe PID: 310 Parent PID: 24 File Activities File Written Analysis Process: rundll32.exe PID: 3116 Parent PID: 310 Analysis Process: rundll32.exe PID: 3124 Parent PID: 310 Analysis Process: rundll32.exe PID: 3132 Parent PID: 310 Disassembly Code Analysis Copyright Joe Security LLC 201 Page 3 of 19

4 Analysis Report Overview Information Joe Sandbox Version: Analysis ID: 4299 Start time: 14:04:33 Joe Sandbox Product: CloudBasic Start date: Overall analysis duration: Hypervisor based Inspection enabled: Report type: Sample file name: Cookbook file name: 0h 1m 24s false light Trojan-Banker.Win32.Generic_002.malware (renamed file extension from malware to dll) default.jbs Analysis system description: Windows 7 SP1 (with Office 2010 SP2 IE 11 FF 54 Chrome 60 Acrobat Reader DC 17 Flash 26 Java ) Number of analysed new started processes analysed: 5 Number of new started drivers analysed: 0 Number of existing processes analysed: 0 Number of existing drivers analysed: 0 Number of injected processes analysed: 0 Technologies Detection: Classification: MAL HCA enabled EGA enabled HDC enabled mal60.evad.windll@7/1@0/0 HCA Information: Successful ratio: 100% Number of executed functions: 0 Number of non-executed functions: 0 EGA Information: HDC Information: Cookbook Comments: Warnings: Failed Failed Stop behavior analysis all processes terminated Show All Exclude process from analysis (whitelisted): dllhost.exe Detection Strategy Score Range Reporting Detection Threshold Report FP / FN Confidence Strategy Score Range Further Analysis Required? Confidence Copyright Joe Security LLC 201 Page 4 of 19

5 Strategy Score Range Further Analysis Required? Threshold false Confidence Classification Ransomware Miner Spreading malicious malicious malicious Evader Phishing suspicious suspicious suspicious clean clean clean Exploiter Banker Spyware Trojan / Bot Adware Signature Overview Copyright Joe Security LLC 201 Page 5 of 19

6 AV Detection Networking Data Obfuscation System Summary Anti Debugging Malware Analysis System Evasion Click to jump to signature section AV Detection: Antivirus detection for submitted file Networking: Urls found in memory or binary data Data Obfuscation: Entry point lies outside standard sections PE file contains sections with non-standard names Binary contains a suspicious time stamp System Summary: PE file has a high image base often used for DLLs Submission file is bigger than most known malware samples PE file has a big raw section Classification label Reads software policies Runs a DLL by calling functions Sample is known by Antivirus (Virustotal or Metascan) Spawns processes PE file contains more sections than normal Anti Debugging: Program does not show much activity (idle) Malware Analysis System Evasion: Program does not show much activity (idle) Tries to detect sandboxes and other dynamic analysis tools (process name) Behavior Graph Copyright Joe Security LLC 201 Page 6 of 19

7 Hide Legend Behavior Graph ID: 4299 Sample: Trojan-Banker.Win32.Generic_002.malware Startdate: 17/01/201 Architecture: WINDOWS Score: 60 Legend: Process Signature Created File DNS/IP Info Is Dropped Is Windows Process Number of created Registry Values Number of created Files Visual Basic Delphi Antivirus detection for submitted file PE file contains more sections than normal Tries to detect sandboxes and other dynamic analysis tools (process name) Binary contains a suspicious time stamp Java started.net C# or VB.NET C C++ or other language Is malicious loaddll32.exe started started started rundll32.exe rundll32.exe rundll32.exe Simulations Behavior and APIs Time Type Description 14:05:14 API Interceptor 3x Sleep call for process: loaddll32.exe modified from: 3000ms to: 100ms Antivirus Detection Initial Sample Source Detection Cloud Link Trojan-Banker.Win32.Generic_00.dll 69% virustotal Browse Dropped Files No Antivirus matches Domains No Antivirus matches Copyright Joe Security LLC 201 Page 7 of 19

8 Yara Overview Initial Sample No yara matches PCAP (Network Traffic) No yara matches Dropped Files No yara matches Memory Dumps No yara matches Unpacked PEs No yara matches Joe Sandbox View / Context IPs No context Domains No context ASN No context Dropped Files No context Screenshot Copyright Joe Security LLC 201 Page of 19

9 Startup System is w7 cleanup loaddll32.exe (PID: 310 cmdline: loaddll32.exe 'C:\Users\user\Desktop\Trojan-Banker.Win32.Generic_002.dll' MD5: D2792A55032CFE25F07DCD4BEC5F40F) rundll32.exe (PID: 3116 cmdline: rundll32.exe C:\Users\user\Desktop\Trojan-Banker.Win32.Generic_002.dllCryptUIWizExport MD5: C E275CF2AD04B67A6CE2) rundll32.exe (PID: 3124 cmdline: rundll32.exe MD5: C E275CF2AD04B67A6CE2) rundll32.exe (PID: 3132 cmdline: rundll32.exe C:\Users\user\Desktop\Trojan-Banker.Win32.Generic_002.dllGetName MD5: C E275CF2AD04B67A6CE2) Created / dropped Files unknown File Type: Size (bytes): 412 ASCII text with CRLF line terminators Entropy (bit): Encrypted: MD5: SHA1: SHA-256: SHA-512: Malicious: Reputation: false A7DAC900BF25DE2CCBBFB699657A47E 0A7DD0413CDAB35DF77C2BED66E4C A2FD2CABE4FBFC0D77EB04D6563EB150D96BAAA4034E7B9CFC9F 404FD95BF2DB3CADF6F7214C2FCB43674B3A1AA449D145F9002BD4BCE9E9D17CDEC99147EBF5B69C949 B4ED240FB44F37290C47BF696596EB4C661AD false low Copyright Joe Security LLC 201 Page 9 of 19

10 Contacted Domains/Contacted IPs Contacted Domains No contacted domains info Contacted IPs No contacted IP infos Static File Info File type: Entropy (bit): PE32 executable (DLL) (console) Intel 036 (stripped to external PDB) for MS Windows TrID: Win32 Dynamic Link Library (generic) ( /3) 99.45% Generic Win/DOS Executable (2004/3) 0.20% DOS Executable Generic (2002/1) 0.20% Java Script embedded in Visual Basic Script (1500/0) 0.15% VXD Driver (31/22) 0.00% File name: File size: MD5: SHA1: SHA256: SHA512: File Content Preview: Trojan-Banker.Win32.Generic_00.dll 73d702311bc94d7cdbfb99d07bf7405c 392edadc7cc722b565cdc5953ea42c45a33 d7db3daada125199effeb aa4e6e15fb0d1c1f94 46e46d0d12ce43136 a1fa63ee37e4e b04f5fca70ed29cff3a099ca44 75f93f45c0fed50fa1edb15606da6f75470dc29ff7b46be 7d59136c3db30723f c5ae is program cannot be run in DOS mode...$...pe..l... un...# t $h p..u.. File Icon Static PE Info Entrypoint: Entrypoint Section: Digitally signed: Imagebase: Subsystem: Image File Characteristics: DLL Characteristics: Time Stamp: TLS Callbacks: CLR (.Net) Version: OS Version Major: 5 OS Version Minor: 0 File Version Major: 5 File Version Minor: 0 Subsystem Version Major: 5 Subsystem Version Minor: 0 Import Hash: 0x aea1 false 0x windows cui LOCAL_SYMS_STRIPPED 32BIT_MACHINE EXECUTABLE_IMAGE DLL DEBUG_STRIPPED LINE_NUMS_STRIPPED 0x6E755F5F [Thu Sep 21 21:51: UTC] 0x65492b2 0x x f49f2167f2d462ea27ca05930d46 Copyright Joe Security LLC 201 Page 10 of 19

11 Entrypoint Preview Instruction jmp 00007FD52105B5AAh clc mov eax dword ptr [ Dh] jmp 00007FD52104E61Bh Copyright Joe Security LLC 201 Page 11 of 19

12 Instruction Data Directories Name Virtual Address Virtual Size Is in Section IMAGE_DIRECTORY_ENTRY_EXPORT 0x7000 0x75.edata IMAGE_DIRECTORY_ENTRY_IMPORT 0x xb4.aea1 IMAGE_DIRECTORY_ENTRY_RESOURCE 0x0 0x0 IMAGE_DIRECTORY_ENTRY_EXCEPTION 0x0 0x0 IMAGE_DIRECTORY_ENTRY_SECURITY 0x0 0x0 IMAGE_DIRECTORY_ENTRY_BASERELOC 0x x1e5c.reloc IMAGE_DIRECTORY_ENTRY_DEBUG 0x0 0x0 IMAGE_DIRECTORY_ENTRY_COPYRIGHT 0x0 0x0 IMAGE_DIRECTORY_ENTRY_GLOBALPTR 0x0 0x0 IMAGE_DIRECTORY_ENTRY_TLS 0x3106b0 0x2.aea1 IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG 0x0 0x0 IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT 0x0 0x0 IMAGE_DIRECTORY_ENTRY_IAT 0x x.aea1 IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT 0x0 0x0 IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR 0x0 0x0 IMAGE_DIRECTORY_ENTRY_RESERVED 0x0 0x0 Sections Name Virtual Address Virtual Size Raw Size Xored PE ZLIB Complexity File Type Entropy Characteristics Copyright Joe Security LLC 201 Page 12 of 19

13 Name Virtual Address Virtual Size Raw Size Xored PE ZLIB Complexity File Type Entropy Characteristics.text 0x1000 0x15a4 0x1600 False data IMAGE_SCN_ALIGN_MASK IMAGE_SCN_ALIGN_256BYTE S IMAGE_SCN_ALIGN_1BYTES IMAGE_SCN_MEM_EXECUTE D_DATA IMAGE_SCN_ALIGN_204BYT ES ES IMAGE_SCN_ALIGN_4BYTES IMAGE_SCN_ALIGN_BYTES IMAGE_SCN_CNT_CODE IMAGE_SCN_ALIGN_192BYT ES ES IMAGE_SCN_MEM_READ.data 0x3000 0x1c 0x200 False AIX core file fulldump 32-bit 64- bit IMAGE_SCN_ALIGN_MASK IMAGE_SCN_ALIGN_256BYTE S IMAGE_SCN_ALIGN_2BYTES IMAGE_SCN_ALIGN_1BYTES D_DATA ES IMAGE_SCN_MEM_WRITE IMAGE_SCN_ALIGN_512BYTE S IMAGE_SCN_ALIGN_4BYTES IMAGE_SCN_ALIGN_192BYT ES ES IMAGE_SCN_MEM_READ.rdata 0x4000 0x5f0 0x600 False data IMAGE_SCN_ALIGN_MASK IMAGE_SCN_ALIGN_256BYTE S IMAGE_SCN_ALIGN_2BYTES IMAGE_SCN_ALIGN_1BYTES D_DATA ES IMAGE_SCN_ALIGN_512BYTE S IMAGE_SCN_ALIGN_4BYTES IMAGE_SCN_ALIGN_192BYT ES ES IMAGE_SCN_MEM_READ Copyright Joe Security LLC 201 Page 13 of 19

14 Name Virtual Address Virtual Size Raw Size Xored PE ZLIB Complexity File Type Entropy Characteristics.eh_fram 0x5000 0x7d0 0x00 False data IMAGE_SCN_ALIGN_MASK IMAGE_SCN_ALIGN_256BYTE S IMAGE_SCN_ALIGN_2BYTES IMAGE_SCN_ALIGN_1BYTES D_DATA ES IMAGE_SCN_ALIGN_512BYTE S IMAGE_SCN_ALIGN_4BYTES IMAGE_SCN_ALIGN_192BYT ES ES IMAGE_SCN_MEM_READ.bss 0x6000 0x3c 0x0 False 0 empty 0.0 IMAGE_SCN_ALIGN_MASK IMAGE_SCN_ALIGN_2BYTES IMAGE_SCN_ALIGN_204BYT ES ES IMAGE_SCN_MEM_WRITE IMAGE_SCN_ALIGN_512BYTE S IMAGE_SCN_CNT_UNINITIALI ZED_DATA IMAGE_SCN_ALIGN_4BYTES IMAGE_SCN_ALIGN_BYTES IMAGE_SCN_ALIGN_192BYT ES ES IMAGE_SCN_MEM_READ.edata 0x7000 0x75 0x200 False data IMAGE_SCN_ALIGN_MASK IMAGE_SCN_ALIGN_256BYTE S IMAGE_SCN_ALIGN_2BYTES IMAGE_SCN_ALIGN_1BYTES D_DATA ES IMAGE_SCN_ALIGN_512BYTE S IMAGE_SCN_ALIGN_4BYTES IMAGE_SCN_ALIGN_192BYT ES ES IMAGE_SCN_MEM_READ Copyright Joe Security LLC 201 Page 14 of 19

15 Name Virtual Address Virtual Size Raw Size Xored PE ZLIB Complexity File Type Entropy Characteristics.idata 0x000 0x4e0 0x600 False data IMAGE_SCN_ALIGN_MASK IMAGE_SCN_ALIGN_256BYTE S IMAGE_SCN_ALIGN_2BYTES IMAGE_SCN_ALIGN_1BYTES D_DATA ES IMAGE_SCN_MEM_WRITE IMAGE_SCN_ALIGN_512BYTE S IMAGE_SCN_ALIGN_4BYTES IMAGE_SCN_ALIGN_192BYT ES ES IMAGE_SCN_MEM_READ.CRT 0x9000 0x2c 0x200 False data IMAGE_SCN_ALIGN_MASK IMAGE_SCN_ALIGN_256BYTE S IMAGE_SCN_ALIGN_2BYTES IMAGE_SCN_ALIGN_1BYTES D_DATA ES IMAGE_SCN_MEM_WRITE IMAGE_SCN_ALIGN_512BYTE S IMAGE_SCN_ALIGN_4BYTES IMAGE_SCN_ALIGN_192BYT ES ES IMAGE_SCN_MEM_READ.tls 0xa000 0x20 0x200 False data IMAGE_SCN_ALIGN_MASK IMAGE_SCN_ALIGN_256BYTE S IMAGE_SCN_ALIGN_2BYTES IMAGE_SCN_ALIGN_1BYTES D_DATA ES IMAGE_SCN_MEM_WRITE IMAGE_SCN_ALIGN_512BYTE S IMAGE_SCN_ALIGN_4BYTES IMAGE_SCN_ALIGN_192BYT ES ES IMAGE_SCN_MEM_READ.aea0 0xb000 0x2c4fa3 0x2c5000 unknown unknown unknown unknown IMAGE_SCN_MEM_EXECUTE D_DATA IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_READ.aea1 0x2d0000 0x x45600 False data IMAGE_SCN_MEM_EXECUTE D_DATA IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_READ Copyright Joe Security LLC 201 Page 15 of 19

16 Name Virtual Address Virtual Size Raw Size Xored PE ZLIB Complexity File Type Entropy Characteristics.reloc 0x x1e5c 0x2000 False data IMAGE_SCN_ALIGN_MASK IMAGE_SCN_ALIGN_256BYTE S IMAGE_SCN_ALIGN_2BYTES IMAGE_SCN_ALIGN_1BYTES D_DATA ES IMAGE_SCN_ALIGN_512BYTE S IMAGE_SCN_ALIGN_4BYTES IMAGE_SCN_ALIGN_192BYT ES IMAGE_SCN_MEM_DISCARD ABLE ES IMAGE_SCN_MEM_READ Imports DLL KERNEL32.dll msvcrt.dll WTSAPI32.dll KERNEL32.dll USER32.dll ADVAPI32.dll KERNEL32.dll ADVAPI32.dll Import DeleteCriticalSection dllonexit WTSSendMessageW LoadLibraryA CharUpperBuffW RegQueryValueExA LocalAlloc GetCurrentProcess GetCurrentThread LocalFree GetModuleFileNameW GetProcessAffinityMask SetProcessAffinityMask SetThreadAffinityMask Sleep ExitProcess GetLastError FreeLibrary LoadLibraryA GetModuleHandleA GetProcAddress OpenSCManagerW EnumServicesStatusExW OpenServiceW QueryServiceConfigW CloseServiceHandle Exports Name Ordinal Address CryptUIWizExport 1 0x62415e0 DllMain@12 2 0x GetName 3 0x62415d0 Network Behavior No network behavior found Code Manipulations Statistics Behavior loaddll32.exe rundll32.exe Copyright Joe Security LLC 201 Page 16 of 19

17 rundll32.exe rundll32.exe Click to jump to process System Behavior Analysis Process: loaddll32.exe PID: 310 Parent PID: 24 Start time: 14:05:14 Start date: 17/01/201 Path: Wow64 process (32bit): Commandline: Imagebase: File size: MD5 hash: Programmed in: Reputation: C:\Windows\System32\loaddll32.exe false loaddll32.exe 'C:\Users\user\Desktop\Trojan-Banker.Win32.Generic_002.dll' 0x774a bytes D2792A55032CFE25F07DCD4BEC5F40F C C++ or other language moderate File Activities File Written File Path Offset Length Value Ascii Completion Count Source Address Symbol Copyright Joe Security LLC 201 Page 17 of 19

18 File Path Offset Length Value Ascii Completion Count Source Address unknown unknown f 75 6e 64 3a Found: 6 exports success or wait 1 12DA7D2 WriteFile f calling..call exports 2c c 6c Successfully called cmd 6e 67 0d 0a c line rundll32.exe C:\Us 6c f ers\user\desktop\trojan d 0a Banker Win32.Generic_002.dllCr 6c 6c c 6c yptui d WizExport..Successfully 6c 69 6e called cmd line 6e 64 6c 6c e rundll32.exe C:\User a 5c s\user\desktop\trojan-ban c c b e 5c b 74 6f 70 5c f 6a 61 6e 2d e 6b e e e e f e 64 6c 6c 2c a f d 0a c 6c c 6c d c 69 6e e 64 6c 6c e a 5c c c b e 5c b 74 6f 70 5c f 6a 61 6e 2d e Symbol Analysis Process: rundll32.exe PID: 3116 Parent PID: 310 Start time: 14:05:14 Start date: 17/01/201 Path: Wow64 process (32bit): Commandline: Imagebase: File size: MD5 hash: Programmed in: Reputation: C:\Windows\System32\rundll32.exe false rundll32.exe C:\Users\user\Desktop\Trojan-Banker.Win32.Generic_002.dllCryptUIWizExport 0x774a bytes C E275CF2AD04B67A6CE2 C C++ or other language moderate Analysis Process: rundll32.exe PID: 3124 Parent PID: 310 Start time: 14:05:15 Start date: 17/01/201 Path: Wow64 process (32bit): Commandline: Imagebase: File size: MD5 hash: Programmed in: Reputation: C:\Windows\System32\rundll32.exe false rundll32.exe C:\Users\user\Desktop\Trojan-Banker.Win32.Generic_002.dllDllMain@12 0x774a bytes C E275CF2AD04B67A6CE2 C C++ or other language moderate Copyright Joe Security LLC 201 Page 1 of 19

19 Analysis Process: rundll32.exe PID: 3132 Parent PID: 310 Start time: 14:05:16 Start date: 17/01/201 Path: Wow64 process (32bit): Commandline: Imagebase: File size: MD5 hash: Programmed in: Reputation: C:\Windows\System32\rundll32.exe false rundll32.exe C:\Users\user\Desktop\Trojan-Banker.Win32.Generic_002.dllGetName 0x75a bytes C E275CF2AD04B67A6CE2 C C++ or other language moderate Disassembly Code Analysis Copyright Joe Security LLC 201 Page 19 of 19