Summary | ZeroBOX

Category	Machine	Started	Completed
FILE	s1_win7_x6402	April 20, 2021, 9:17 a.m.	April 20, 2021, 9:23 a.m.

Size	966.5KB
Type	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
MD5	`340994098deb6bf6fa91f73350af7c15`
SHA256	`da81aa0dd37baccdbdc7f7f9a3619d6e85155f8bd67fcd2fafdbe534443fdc0c`
CRC32	`8EBEE21A`
ssdeep	`24576:9uxbU2AOgFXP8+MAdInh86SYuvBwbRxa3i5wlTDqtOsGQlqcVIQ0P:sxbU2AO2P89UIh86SYuvBwbRxa3wm3qE`
PDB Path	c:\Roll\exercise-Dad\bar\Lead\Group.pdb
Yara	Win32_Trojan_Gen_2_0904B0_Zero - Win32 Trojan Gen Win32_Trojan_Gen_1_0904B0_Zero - Win32 Trojan Emotet win_files_operation - Affect private profile PE_Header_Zero - PE File Signature Zero OS_Processor_Check_Zero - OS Processor Check Signature Zero IsPE32 - (no description) IsDLL - (no description) IsWindowsGUI - (no description) HasDebugData - DebugData Check HasRichSignature - Rich Signature Check

rundll32.exe "C:\Windows\System32\rundll32.exe" C:\Users\test22\AppData\Local\Temp\g1mrfi.rar.dll,Babydream
3332
rundll32.exe "C:\Windows\System32\rundll32.exe" C:\Users\test22\AppData\Local\Temp\g1mrfi.rar.dll,Finalplay
5192
rundll32.exe "C:\Windows\System32\rundll32.exe" C:\Users\test22\AppData\Local\Temp\g1mrfi.rar.dll,Milkwhole
8232
rundll32.exe "C:\Windows\System32\rundll32.exe" C:\Users\test22\AppData\Local\Temp\g1mrfi.rar.dll,SpeedBig
3388
rundll32.exe "C:\Windows\System32\rundll32.exe" C:\Users\test22\AppData\Local\Temp\g1mrfi.rar.dll,Thisfrom
8400
rundll32.exe "C:\Windows\System32\rundll32.exe" C:\Users\test22\AppData\Local\Temp\g1mrfi.rar.dll,
4884

Name	Response	Post-Analysis Lookup
edgedl.gvt1.com	A 142.250.34.2	142.250.34.2

IP Address	Status	Action
142.250.34.2	Active	Moloch
164.124.101.2	Active	Moloch
172.217.25.14	Active	Moloch

Suricata Alerts

Flow	SID	Signature	Category
TCP 192.168.56.102:49819 -> 172.217.24.67:443	906200022	SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee)	undefined
TCP 192.168.56.102:49824 -> 172.217.24.67:443	906200022	SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee)	undefined
TCP 142.250.34.2:80 -> 192.168.56.102:49820	2018959	ET POLICY PE EXE or DLL Windows file download HTTP	Potential Corporate Privacy Violation
TCP 142.250.34.2:80 -> 192.168.56.102:49820	2014520	ET INFO EXE - Served Attached HTTP	Misc activity
TCP 192.168.56.102:49823 -> 172.217.24.67:443	906200022	SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee)	undefined
TCP 142.250.34.2:80 -> 192.168.56.102:49820	2015744	ET INFO EXE IsDebuggerPresent (Used in Malware Anti-Debugging)	Misc activity

Suricata TLS

Flow	Issuer	Subject	Fingerprint
TLS 1.2 192.168.56.102:49819 172.217.24.67:443	C=US, O=Google Trust Services, CN=GTS CA 1O1	C=US, ST=California, L=Mountain View, O=Google LLC, CN=upload.video.google.com	c2:b5:f0:1b:46:55:3f:d3:65:b2:1d:5c:cc:56:a7:41:ac:9c:7a:22
TLS 1.2 192.168.56.102:49824 172.217.24.67:443	C=US, O=Google Trust Services, CN=GTS CA 1O1	C=US, ST=California, L=Mountain View, O=Google LLC, CN=upload.video.google.com	c2:b5:f0:1b:46:55:3f:d3:65:b2:1d:5c:cc:56:a7:41:ac:9c:7a:22
TLS 1.2 192.168.56.102:49823 172.217.24.67:443	C=US, O=Google Trust Services, CN=GTS CA 1O1	C=US, ST=California, L=Mountain View, O=Google LLC, CN=upload.video.google.com	c2:b5:f0:1b:46:55:3f:d3:65:b2:1d:5c:cc:56:a7:41:ac:9c:7a:22

This executable has a PDB path (1 event)

pdb_path

c:\Roll\exercise-Dad\bar\Lead\Group.pdb

The executable contains unknown PE section names indicative of a packer (could be a false positive) (1 event)

section

.gfids

One or more processes crashed (50 out of 175 events)

Time & API	Arguments	Status
__exception__ April 20, 2021, 9:18 a.m.	stacktrace: exception.instruction_r: cc c3 5d c3 33 c0 5d c3 68 e0 7d b6 c0 68 ea b3 exception.instruction: int3 exception.exception_code: 0x80000003 exception.symbol: DllRegisterServer+0x72ec g1mrfi+0x1105c exception.address: 0x7209105c registers.esp: 2618488 registers.edi: 2960344 registers.eax: 2000478246 registers.ebp: 2000552521 registers.edx: 129161 registers.ebx: 2704346981 registers.esi: 1970405376 registers.ecx: 66040	1
__exception__ April 20, 2021, 9:18 a.m.	stacktrace: exception.instruction_r: cc c3 5d c3 33 c0 5d c3 68 e0 7d b6 c0 68 ea b3 exception.instruction: int3 exception.exception_code: 0x80000003 exception.symbol: DllRegisterServer+0x72ec g1mrfi+0x1105c exception.address: 0x7209105c registers.esp: 2618464 registers.edi: 16 registers.eax: 2000478246 registers.ebp: 8194000 registers.edx: 0 registers.ebx: 0 registers.esi: 64 registers.ecx: 0	1
__exception__ April 20, 2021, 9:18 a.m.	stacktrace: exception.instruction_r: cc c3 5d c3 33 c0 5d c3 68 e0 7d b6 c0 68 ea b3 exception.instruction: int3 exception.exception_code: 0x80000003 exception.symbol: DllRegisterServer+0x72ec g1mrfi+0x1105c exception.address: 0x7209105c registers.esp: 2618464 registers.edi: 15 registers.eax: 2000478246 registers.ebp: 8194016 registers.edx: 0 registers.ebx: 0 registers.esi: 64 registers.ecx: 0	1
__exception__ April 20, 2021, 9:18 a.m.	stacktrace: exception.instruction_r: cc c3 5d c3 33 c0 5d c3 68 e0 7d b6 c0 68 ea b3 exception.instruction: int3 exception.exception_code: 0x80000003 exception.symbol: DllRegisterServer+0x72ec g1mrfi+0x1105c exception.address: 0x7209105c registers.esp: 2618464 registers.edi: 14 registers.eax: 2000478246 registers.ebp: 8194032 registers.edx: 0 registers.ebx: 0 registers.esi: 64 registers.ecx: 0	1
__exception__ April 20, 2021, 9:18 a.m.	stacktrace: exception.instruction_r: cc c3 5d c3 33 c0 5d c3 68 e0 7d b6 c0 68 ea b3 exception.instruction: int3 exception.exception_code: 0x80000003 exception.symbol: DllRegisterServer+0x72ec g1mrfi+0x1105c exception.address: 0x7209105c registers.esp: 2618464 registers.edi: 13 registers.eax: 2000478246 registers.ebp: 8194048 registers.edx: 0 registers.ebx: 0 registers.esi: 64 registers.ecx: 0	1
__exception__ April 20, 2021, 9:18 a.m.	stacktrace: exception.instruction_r: cc c3 5d c3 33 c0 5d c3 68 e0 7d b6 c0 68 ea b3 exception.instruction: int3 exception.exception_code: 0x80000003 exception.symbol: DllRegisterServer+0x72ec g1mrfi+0x1105c exception.address: 0x7209105c registers.esp: 2618464 registers.edi: 12 registers.eax: 2000478246 registers.ebp: 8194064 registers.edx: 0 registers.ebx: 0 registers.esi: 64 registers.ecx: 0	1
__exception__ April 20, 2021, 9:18 a.m.	stacktrace: exception.instruction_r: cc c3 5d c3 33 c0 5d c3 68 e0 7d b6 c0 68 ea b3 exception.instruction: int3 exception.exception_code: 0x80000003 exception.symbol: DllRegisterServer+0x72ec g1mrfi+0x1105c exception.address: 0x7209105c registers.esp: 2618464 registers.edi: 11 registers.eax: 2000478246 registers.ebp: 8194080 registers.edx: 0 registers.ebx: 0 registers.esi: 64 registers.ecx: 0	1
__exception__ April 20, 2021, 9:18 a.m.	stacktrace: exception.instruction_r: cc c3 5d c3 33 c0 5d c3 68 e0 7d b6 c0 68 ea b3 exception.instruction: int3 exception.exception_code: 0x80000003 exception.symbol: DllRegisterServer+0x72ec g1mrfi+0x1105c exception.address: 0x7209105c registers.esp: 2618464 registers.edi: 10 registers.eax: 2000478246 registers.ebp: 8194096 registers.edx: 0 registers.ebx: 0 registers.esi: 64 registers.ecx: 0	1
__exception__ April 20, 2021, 9:18 a.m.	stacktrace: exception.instruction_r: cc c3 5d c3 33 c0 5d c3 68 e0 7d b6 c0 68 ea b3 exception.instruction: int3 exception.exception_code: 0x80000003 exception.symbol: DllRegisterServer+0x72ec g1mrfi+0x1105c exception.address: 0x7209105c registers.esp: 2618464 registers.edi: 9 registers.eax: 2000478246 registers.ebp: 8194112 registers.edx: 0 registers.ebx: 0 registers.esi: 64 registers.ecx: 0	1
__exception__ April 20, 2021, 9:18 a.m.	stacktrace: exception.instruction_r: cc c3 5d c3 33 c0 5d c3 68 e0 7d b6 c0 68 ea b3 exception.instruction: int3 exception.exception_code: 0x80000003 exception.symbol: DllRegisterServer+0x72ec g1mrfi+0x1105c exception.address: 0x7209105c registers.esp: 2618464 registers.edi: 8 registers.eax: 2000478246 registers.ebp: 8194128 registers.edx: 0 registers.ebx: 0 registers.esi: 64 registers.ecx: 0	1
__exception__ April 20, 2021, 9:18 a.m.	stacktrace: exception.instruction_r: cc c3 5d c3 33 c0 5d c3 68 e0 7d b6 c0 68 ea b3 exception.instruction: int3 exception.exception_code: 0x80000003 exception.symbol: DllRegisterServer+0x72ec g1mrfi+0x1105c exception.address: 0x7209105c registers.esp: 2618464 registers.edi: 7 registers.eax: 2000478246 registers.ebp: 8194144 registers.edx: 0 registers.ebx: 0 registers.esi: 64 registers.ecx: 0	1
__exception__ April 20, 2021, 9:18 a.m.	stacktrace: exception.instruction_r: cc c3 5d c3 33 c0 5d c3 68 e0 7d b6 c0 68 ea b3 exception.instruction: int3 exception.exception_code: 0x80000003 exception.symbol: DllRegisterServer+0x72ec g1mrfi+0x1105c exception.address: 0x7209105c registers.esp: 2618464 registers.edi: 6 registers.eax: 2000478246 registers.ebp: 8194160 registers.edx: 0 registers.ebx: 0 registers.esi: 64 registers.ecx: 0	1
__exception__ April 20, 2021, 9:18 a.m.	stacktrace: exception.instruction_r: cc c3 5d c3 33 c0 5d c3 68 e0 7d b6 c0 68 ea b3 exception.instruction: int3 exception.exception_code: 0x80000003 exception.symbol: DllRegisterServer+0x72ec g1mrfi+0x1105c exception.address: 0x7209105c registers.esp: 2618464 registers.edi: 5 registers.eax: 2000478246 registers.ebp: 8194176 registers.edx: 0 registers.ebx: 0 registers.esi: 64 registers.ecx: 0	1
__exception__ April 20, 2021, 9:18 a.m.	stacktrace: exception.instruction_r: cc c3 5d c3 33 c0 5d c3 68 e0 7d b6 c0 68 ea b3 exception.instruction: int3 exception.exception_code: 0x80000003 exception.symbol: DllRegisterServer+0x72ec g1mrfi+0x1105c exception.address: 0x7209105c registers.esp: 2618464 registers.edi: 4 registers.eax: 2000478246 registers.ebp: 8194192 registers.edx: 0 registers.ebx: 0 registers.esi: 64 registers.ecx: 0	1
__exception__ April 20, 2021, 9:18 a.m.	stacktrace: exception.instruction_r: cc c3 5d c3 33 c0 5d c3 68 e0 7d b6 c0 68 ea b3 exception.instruction: int3 exception.exception_code: 0x80000003 exception.symbol: DllRegisterServer+0x72ec g1mrfi+0x1105c exception.address: 0x7209105c registers.esp: 2618464 registers.edi: 3 registers.eax: 2000478246 registers.ebp: 8194208 registers.edx: 0 registers.ebx: 0 registers.esi: 64 registers.ecx: 0	1
__exception__ April 20, 2021, 9:18 a.m.	stacktrace: exception.instruction_r: cc c3 5d c3 33 c0 5d c3 68 e0 7d b6 c0 68 ea b3 exception.instruction: int3 exception.exception_code: 0x80000003 exception.symbol: DllRegisterServer+0x72ec g1mrfi+0x1105c exception.address: 0x7209105c registers.esp: 2618464 registers.edi: 2 registers.eax: 2000478246 registers.ebp: 8194224 registers.edx: 0 registers.ebx: 0 registers.esi: 64 registers.ecx: 0	1
__exception__ April 20, 2021, 9:18 a.m.	stacktrace: exception.instruction_r: cc c3 5d c3 33 c0 5d c3 68 e0 7d b6 c0 68 ea b3 exception.instruction: int3 exception.exception_code: 0x80000003 exception.symbol: DllRegisterServer+0x72ec g1mrfi+0x1105c exception.address: 0x7209105c registers.esp: 2618464 registers.edi: 1 registers.eax: 2000478246 registers.ebp: 8194240 registers.edx: 0 registers.ebx: 0 registers.esi: 64 registers.ecx: 0	1
__exception__ April 20, 2021, 9:18 a.m.	stacktrace: DllRegisterServer+0xcbc7 g1mrfi+0x16937 @ 0x72096937 exception.instruction_r: cc c3 5d c3 33 c0 5d c3 68 e0 7d b6 c0 68 ea b3 exception.instruction: int3 exception.exception_code: 0x80000003 exception.symbol: DllRegisterServer+0x72ec g1mrfi+0x1105c exception.address: 0x7209105c registers.esp: 2617656 registers.edi: 12 registers.eax: 2000478246 registers.ebp: 2618732 registers.edx: 23 registers.ebx: 2618748 registers.esi: 23 registers.ecx: 0	1
__exception__ April 20, 2021, 9:18 a.m.	stacktrace: exception.instruction_r: cc c3 5d c3 33 c0 5d c3 68 e0 7d b6 c0 68 ea b3 exception.instruction: int3 exception.exception_code: 0x80000003 exception.symbol: DllRegisterServer+0x72ec g1mrfi+0x1105c exception.address: 0x7209105c registers.esp: 2618716 registers.edi: 6 registers.eax: 2000478246 registers.ebp: 96784 registers.edx: 827898 registers.ebx: 0 registers.esi: 282 registers.ecx: 0	1
__exception__ April 20, 2021, 9:18 a.m.	stacktrace: exception.instruction_r: cc c3 5d c3 33 c0 5d c3 68 e0 7d b6 c0 68 ea b3 exception.instruction: int3 exception.exception_code: 0x80000003 exception.symbol: DllRegisterServer+0x72ec g1mrfi+0x1105c exception.address: 0x7209105c registers.esp: 2618692 registers.edi: 6 registers.eax: 2000478246 registers.ebp: 16 registers.edx: 0 registers.ebx: 64 registers.esi: 8197480 registers.ecx: 0	1
__exception__ April 20, 2021, 9:18 a.m.	stacktrace: exception.instruction_r: cc c3 5d c3 33 c0 5d c3 68 e0 7d b6 c0 68 ea b3 exception.instruction: int3 exception.exception_code: 0x80000003 exception.symbol: DllRegisterServer+0x72ec g1mrfi+0x1105c exception.address: 0x7209105c registers.esp: 2618692 registers.edi: 6 registers.eax: 2000478246 registers.ebp: 15 registers.edx: 0 registers.ebx: 64 registers.esi: 8197504 registers.ecx: 0	1
__exception__ April 20, 2021, 9:18 a.m.	stacktrace: exception.instruction_r: cc c3 5d c3 33 c0 5d c3 68 e0 7d b6 c0 68 ea b3 exception.instruction: int3 exception.exception_code: 0x80000003 exception.symbol: DllRegisterServer+0x72ec g1mrfi+0x1105c exception.address: 0x7209105c registers.esp: 2618692 registers.edi: 6 registers.eax: 2000478246 registers.ebp: 14 registers.edx: 0 registers.ebx: 64 registers.esi: 8197528 registers.ecx: 0	1
__exception__ April 20, 2021, 9:18 a.m.	stacktrace: exception.instruction_r: cc c3 5d c3 33 c0 5d c3 68 e0 7d b6 c0 68 ea b3 exception.instruction: int3 exception.exception_code: 0x80000003 exception.symbol: DllRegisterServer+0x72ec g1mrfi+0x1105c exception.address: 0x7209105c registers.esp: 2618692 registers.edi: 6 registers.eax: 2000478246 registers.ebp: 13 registers.edx: 0 registers.ebx: 64 registers.esi: 8197552 registers.ecx: 0	1
__exception__ April 20, 2021, 9:18 a.m.	stacktrace: exception.instruction_r: cc c3 5d c3 33 c0 5d c3 68 e0 7d b6 c0 68 ea b3 exception.instruction: int3 exception.exception_code: 0x80000003 exception.symbol: DllRegisterServer+0x72ec g1mrfi+0x1105c exception.address: 0x7209105c registers.esp: 2618692 registers.edi: 6 registers.eax: 2000478246 registers.ebp: 12 registers.edx: 0 registers.ebx: 64 registers.esi: 8197576 registers.ecx: 0	1
__exception__ April 20, 2021, 9:18 a.m.	stacktrace: exception.instruction_r: cc c3 5d c3 33 c0 5d c3 68 e0 7d b6 c0 68 ea b3 exception.instruction: int3 exception.exception_code: 0x80000003 exception.symbol: DllRegisterServer+0x72ec g1mrfi+0x1105c exception.address: 0x7209105c registers.esp: 2618692 registers.edi: 6 registers.eax: 2000478246 registers.ebp: 11 registers.edx: 0 registers.ebx: 64 registers.esi: 8197600 registers.ecx: 0	1
__exception__ April 20, 2021, 9:18 a.m.	stacktrace: exception.instruction_r: cc c3 5d c3 33 c0 5d c3 68 e0 7d b6 c0 68 ea b3 exception.instruction: int3 exception.exception_code: 0x80000003 exception.symbol: DllRegisterServer+0x72ec g1mrfi+0x1105c exception.address: 0x7209105c registers.esp: 2618692 registers.edi: 6 registers.eax: 2000478246 registers.ebp: 10 registers.edx: 0 registers.ebx: 64 registers.esi: 8197624 registers.ecx: 0	1
__exception__ April 20, 2021, 9:18 a.m.	stacktrace: exception.instruction_r: cc c3 5d c3 33 c0 5d c3 68 e0 7d b6 c0 68 ea b3 exception.instruction: int3 exception.exception_code: 0x80000003 exception.symbol: DllRegisterServer+0x72ec g1mrfi+0x1105c exception.address: 0x7209105c registers.esp: 2618692 registers.edi: 6 registers.eax: 2000478246 registers.ebp: 9 registers.edx: 0 registers.ebx: 64 registers.esi: 8197648 registers.ecx: 0	1
__exception__ April 20, 2021, 9:18 a.m.	stacktrace: exception.instruction_r: cc c3 5d c3 33 c0 5d c3 68 e0 7d b6 c0 68 ea b3 exception.instruction: int3 exception.exception_code: 0x80000003 exception.symbol: DllRegisterServer+0x72ec g1mrfi+0x1105c exception.address: 0x7209105c registers.esp: 2618692 registers.edi: 6 registers.eax: 2000478246 registers.ebp: 8 registers.edx: 0 registers.ebx: 64 registers.esi: 8197672 registers.ecx: 0	1
__exception__ April 20, 2021, 9:18 a.m.	stacktrace: exception.instruction_r: cc c3 5d c3 33 c0 5d c3 68 e0 7d b6 c0 68 ea b3 exception.instruction: int3 exception.exception_code: 0x80000003 exception.symbol: DllRegisterServer+0x72ec g1mrfi+0x1105c exception.address: 0x7209105c registers.esp: 2618692 registers.edi: 6 registers.eax: 2000478246 registers.ebp: 7 registers.edx: 0 registers.ebx: 64 registers.esi: 8197696 registers.ecx: 0	1
__exception__ April 20, 2021, 9:18 a.m.	stacktrace: exception.instruction_r: cc c3 5d c3 33 c0 5d c3 68 e0 7d b6 c0 68 ea b3 exception.instruction: int3 exception.exception_code: 0x80000003 exception.symbol: DllRegisterServer+0x72ec g1mrfi+0x1105c exception.address: 0x7209105c registers.esp: 2618692 registers.edi: 6 registers.eax: 2000478246 registers.ebp: 6 registers.edx: 0 registers.ebx: 64 registers.esi: 8197720 registers.ecx: 0	1
__exception__ April 20, 2021, 9:18 a.m.	stacktrace: exception.instruction_r: cc c3 5d c3 33 c0 5d c3 68 e0 7d b6 c0 68 ea b3 exception.instruction: int3 exception.exception_code: 0x80000003 exception.symbol: DllRegisterServer+0x72ec g1mrfi+0x1105c exception.address: 0x7209105c registers.esp: 2618692 registers.edi: 6 registers.eax: 2000478246 registers.ebp: 5 registers.edx: 0 registers.ebx: 64 registers.esi: 8197744 registers.ecx: 0	1
__exception__ April 20, 2021, 9:18 a.m.	stacktrace: exception.instruction_r: cc c3 5d c3 33 c0 5d c3 68 e0 7d b6 c0 68 ea b3 exception.instruction: int3 exception.exception_code: 0x80000003 exception.symbol: DllRegisterServer+0x72ec g1mrfi+0x1105c exception.address: 0x7209105c registers.esp: 2618692 registers.edi: 6 registers.eax: 2000478246 registers.ebp: 4 registers.edx: 0 registers.ebx: 64 registers.esi: 8197768 registers.ecx: 0	1
__exception__ April 20, 2021, 9:18 a.m.	stacktrace: exception.instruction_r: cc c3 5d c3 33 c0 5d c3 68 e0 7d b6 c0 68 ea b3 exception.instruction: int3 exception.exception_code: 0x80000003 exception.symbol: DllRegisterServer+0x72ec g1mrfi+0x1105c exception.address: 0x7209105c registers.esp: 2618692 registers.edi: 6 registers.eax: 2000478246 registers.ebp: 3 registers.edx: 0 registers.ebx: 64 registers.esi: 8197792 registers.ecx: 0	1
__exception__ April 20, 2021, 9:18 a.m.	stacktrace: exception.instruction_r: cc c3 5d c3 33 c0 5d c3 68 e0 7d b6 c0 68 ea b3 exception.instruction: int3 exception.exception_code: 0x80000003 exception.symbol: DllRegisterServer+0x72ec g1mrfi+0x1105c exception.address: 0x7209105c registers.esp: 2618692 registers.edi: 6 registers.eax: 2000478246 registers.ebp: 2 registers.edx: 0 registers.ebx: 64 registers.esi: 8197816 registers.ecx: 0	1
__exception__ April 20, 2021, 9:18 a.m.	stacktrace: exception.instruction_r: cc c3 5d c3 33 c0 5d c3 68 e0 7d b6 c0 68 ea b3 exception.instruction: int3 exception.exception_code: 0x80000003 exception.symbol: DllRegisterServer+0x72ec g1mrfi+0x1105c exception.address: 0x7209105c registers.esp: 2618692 registers.edi: 6 registers.eax: 2000478246 registers.ebp: 1 registers.edx: 0 registers.ebx: 64 registers.esi: 8197840 registers.ecx: 0	1
__exception__ April 20, 2021, 9:18 a.m.	stacktrace: exception.instruction_r: cc c3 5d c3 33 c0 5d c3 68 e0 7d b6 c0 68 ea b3 exception.instruction: int3 exception.exception_code: 0x80000003 exception.symbol: DllRegisterServer+0x72ec g1mrfi+0x1105c exception.address: 0x7209105c registers.esp: 2684164 registers.edi: 3288024 registers.eax: 2000478246 registers.ebp: 2000552521 registers.edx: 129161 registers.ebx: 2704346981 registers.esi: 1970405376 registers.ecx: 66040	1
__exception__ April 20, 2021, 9:18 a.m.	stacktrace: exception.instruction_r: cc c3 5d c3 33 c0 5d c3 68 e0 7d b6 c0 68 ea b3 exception.instruction: int3 exception.exception_code: 0x80000003 exception.symbol: DllRegisterServer+0x72ec g1mrfi+0x1105c exception.address: 0x7209105c registers.esp: 2684140 registers.edi: 16 registers.eax: 2000478246 registers.ebp: 33097680 registers.edx: 0 registers.ebx: 0 registers.esi: 64 registers.ecx: 0	1
__exception__ April 20, 2021, 9:18 a.m.	stacktrace: exception.instruction_r: cc c3 5d c3 33 c0 5d c3 68 e0 7d b6 c0 68 ea b3 exception.instruction: int3 exception.exception_code: 0x80000003 exception.symbol: DllRegisterServer+0x72ec g1mrfi+0x1105c exception.address: 0x7209105c registers.esp: 2684140 registers.edi: 15 registers.eax: 2000478246 registers.ebp: 33097696 registers.edx: 0 registers.ebx: 0 registers.esi: 64 registers.ecx: 0	1
__exception__ April 20, 2021, 9:18 a.m.	stacktrace: exception.instruction_r: cc c3 5d c3 33 c0 5d c3 68 e0 7d b6 c0 68 ea b3 exception.instruction: int3 exception.exception_code: 0x80000003 exception.symbol: DllRegisterServer+0x72ec g1mrfi+0x1105c exception.address: 0x7209105c registers.esp: 2684140 registers.edi: 14 registers.eax: 2000478246 registers.ebp: 33097712 registers.edx: 0 registers.ebx: 0 registers.esi: 64 registers.ecx: 0	1
__exception__ April 20, 2021, 9:18 a.m.	stacktrace: exception.instruction_r: cc c3 5d c3 33 c0 5d c3 68 e0 7d b6 c0 68 ea b3 exception.instruction: int3 exception.exception_code: 0x80000003 exception.symbol: DllRegisterServer+0x72ec g1mrfi+0x1105c exception.address: 0x7209105c registers.esp: 2684140 registers.edi: 13 registers.eax: 2000478246 registers.ebp: 33097728 registers.edx: 0 registers.ebx: 0 registers.esi: 64 registers.ecx: 0	1
__exception__ April 20, 2021, 9:18 a.m.	stacktrace: exception.instruction_r: cc c3 5d c3 33 c0 5d c3 68 e0 7d b6 c0 68 ea b3 exception.instruction: int3 exception.exception_code: 0x80000003 exception.symbol: DllRegisterServer+0x72ec g1mrfi+0x1105c exception.address: 0x7209105c registers.esp: 2684140 registers.edi: 12 registers.eax: 2000478246 registers.ebp: 33097744 registers.edx: 0 registers.ebx: 0 registers.esi: 64 registers.ecx: 0	1
__exception__ April 20, 2021, 9:18 a.m.	stacktrace: exception.instruction_r: cc c3 5d c3 33 c0 5d c3 68 e0 7d b6 c0 68 ea b3 exception.instruction: int3 exception.exception_code: 0x80000003 exception.symbol: DllRegisterServer+0x72ec g1mrfi+0x1105c exception.address: 0x7209105c registers.esp: 2684140 registers.edi: 11 registers.eax: 2000478246 registers.ebp: 33097760 registers.edx: 0 registers.ebx: 0 registers.esi: 64 registers.ecx: 0	1
__exception__ April 20, 2021, 9:18 a.m.	stacktrace: exception.instruction_r: cc c3 5d c3 33 c0 5d c3 68 e0 7d b6 c0 68 ea b3 exception.instruction: int3 exception.exception_code: 0x80000003 exception.symbol: DllRegisterServer+0x72ec g1mrfi+0x1105c exception.address: 0x7209105c registers.esp: 2684140 registers.edi: 10 registers.eax: 2000478246 registers.ebp: 33097776 registers.edx: 0 registers.ebx: 0 registers.esi: 64 registers.ecx: 0	1
__exception__ April 20, 2021, 9:18 a.m.	stacktrace: exception.instruction_r: cc c3 5d c3 33 c0 5d c3 68 e0 7d b6 c0 68 ea b3 exception.instruction: int3 exception.exception_code: 0x80000003 exception.symbol: DllRegisterServer+0x72ec g1mrfi+0x1105c exception.address: 0x7209105c registers.esp: 2684140 registers.edi: 9 registers.eax: 2000478246 registers.ebp: 33097792 registers.edx: 0 registers.ebx: 0 registers.esi: 64 registers.ecx: 0	1
__exception__ April 20, 2021, 9:18 a.m.	stacktrace: exception.instruction_r: cc c3 5d c3 33 c0 5d c3 68 e0 7d b6 c0 68 ea b3 exception.instruction: int3 exception.exception_code: 0x80000003 exception.symbol: DllRegisterServer+0x72ec g1mrfi+0x1105c exception.address: 0x7209105c registers.esp: 2684140 registers.edi: 8 registers.eax: 2000478246 registers.ebp: 33097808 registers.edx: 0 registers.ebx: 0 registers.esi: 64 registers.ecx: 0	1
__exception__ April 20, 2021, 9:18 a.m.	stacktrace: exception.instruction_r: cc c3 5d c3 33 c0 5d c3 68 e0 7d b6 c0 68 ea b3 exception.instruction: int3 exception.exception_code: 0x80000003 exception.symbol: DllRegisterServer+0x72ec g1mrfi+0x1105c exception.address: 0x7209105c registers.esp: 2684140 registers.edi: 7 registers.eax: 2000478246 registers.ebp: 33097824 registers.edx: 0 registers.ebx: 0 registers.esi: 64 registers.ecx: 0	1
__exception__ April 20, 2021, 9:18 a.m.	stacktrace: exception.instruction_r: cc c3 5d c3 33 c0 5d c3 68 e0 7d b6 c0 68 ea b3 exception.instruction: int3 exception.exception_code: 0x80000003 exception.symbol: DllRegisterServer+0x72ec g1mrfi+0x1105c exception.address: 0x7209105c registers.esp: 2684140 registers.edi: 6 registers.eax: 2000478246 registers.ebp: 33097840 registers.edx: 0 registers.ebx: 0 registers.esi: 64 registers.ecx: 0	1
__exception__ April 20, 2021, 9:18 a.m.	stacktrace: exception.instruction_r: cc c3 5d c3 33 c0 5d c3 68 e0 7d b6 c0 68 ea b3 exception.instruction: int3 exception.exception_code: 0x80000003 exception.symbol: DllRegisterServer+0x72ec g1mrfi+0x1105c exception.address: 0x7209105c registers.esp: 2684140 registers.edi: 5 registers.eax: 2000478246 registers.ebp: 33097856 registers.edx: 0 registers.ebx: 0 registers.esi: 64 registers.ecx: 0	1
__exception__ April 20, 2021, 9:18 a.m.	stacktrace: exception.instruction_r: cc c3 5d c3 33 c0 5d c3 68 e0 7d b6 c0 68 ea b3 exception.instruction: int3 exception.exception_code: 0x80000003 exception.symbol: DllRegisterServer+0x72ec g1mrfi+0x1105c exception.address: 0x7209105c registers.esp: 2684140 registers.edi: 4 registers.eax: 2000478246 registers.ebp: 33097872 registers.edx: 0 registers.ebx: 0 registers.esi: 64 registers.ecx: 0	1
__exception__ April 20, 2021, 9:18 a.m.	stacktrace: exception.instruction_r: cc c3 5d c3 33 c0 5d c3 68 e0 7d b6 c0 68 ea b3 exception.instruction: int3 exception.exception_code: 0x80000003 exception.symbol: DllRegisterServer+0x72ec g1mrfi+0x1105c exception.address: 0x7209105c registers.esp: 2684140 registers.edi: 3 registers.eax: 2000478246 registers.ebp: 33097888 registers.edx: 0 registers.ebx: 0 registers.esi: 64 registers.ecx: 0	1

HTTP traffic contains suspicious features which may be indicative of malware related traffic (2 events)

suspicious_features	POST method with no referer header				suspicious_request	POST https://update.googleapis.com/service/update2?cup2key=10:4227462757&cup2hreq=368373e8187af8080730cb1ca102e99c23fa418c238c3586be44d3f46bbd62cd
suspicious_features	POST method with no referer header				suspicious_request	POST https://update.googleapis.com/service/update2

Performs some HTTP requests (4 events)

request	HEAD http://edgedl.gvt1.com/edgedl/release2/update2/ALmnr7lDhOvozdF08iOk7Ks_1.3.36.72/GoogleUpdateSetup.exe
request	GET http://edgedl.gvt1.com/edgedl/release2/update2/ALmnr7lDhOvozdF08iOk7Ks_1.3.36.72/GoogleUpdateSetup.exe
request	POST https://update.googleapis.com/service/update2?cup2key=10:4227462757&cup2hreq=368373e8187af8080730cb1ca102e99c23fa418c238c3586be44d3f46bbd62cd
request	POST https://update.googleapis.com/service/update2

Sends data using the HTTP POST Method (2 events)

request	POST https://update.googleapis.com/service/update2?cup2key=10:4227462757&cup2hreq=368373e8187af8080730cb1ca102e99c23fa418c238c3586be44d3f46bbd62cd
request	POST https://update.googleapis.com/service/update2

Allocates read-write-execute memory (usually to unpack itself) (25 events)

Time & API	Arguments	Status
NtProtectVirtualMemory April 20, 2021, 9:17 a.m.	process_identifier: 3332 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x72141000 process_handle: 0xffffffff	1
NtProtectVirtualMemory April 20, 2021, 9:18 a.m.	process_identifier: 3332 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 20480 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x7216d000 process_handle: 0xffffffff	1
NtAllocateVirtualMemory April 20, 2021, 9:18 a.m.	process_identifier: 3332 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00790000 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0xffffffff	1
NtAllocateVirtualMemory April 20, 2021, 9:18 a.m.	process_identifier: 3332 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x007a0000 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0xffffffff	1
NtAllocateVirtualMemory April 20, 2021, 9:18 a.m.	process_identifier: 3332 region_size: 618496 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x007d0000 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0xffffffff	1
NtProtectVirtualMemory April 20, 2021, 9:17 a.m.	process_identifier: 5192 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x72141000 process_handle: 0xffffffff	1
NtProtectVirtualMemory April 20, 2021, 9:18 a.m.	process_identifier: 5192 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 20480 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x7216d000 process_handle: 0xffffffff	1
NtAllocateVirtualMemory April 20, 2021, 9:18 a.m.	process_identifier: 5192 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x007a0000 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0xffffffff	1
NtAllocateVirtualMemory April 20, 2021, 9:18 a.m.	process_identifier: 5192 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x007b0000 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0xffffffff	1
NtAllocateVirtualMemory April 20, 2021, 9:18 a.m.	process_identifier: 5192 region_size: 618496 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x008d0000 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0xffffffff	1
NtProtectVirtualMemory April 20, 2021, 9:17 a.m.	process_identifier: 8232 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x72141000 process_handle: 0xffffffff	1
NtProtectVirtualMemory April 20, 2021, 9:18 a.m.	process_identifier: 8232 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 20480 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x7216d000 process_handle: 0xffffffff	1
NtAllocateVirtualMemory April 20, 2021, 9:18 a.m.	process_identifier: 8232 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00790000 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0xffffffff	1
NtAllocateVirtualMemory April 20, 2021, 9:18 a.m.	process_identifier: 8232 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x007a0000 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0xffffffff	1
NtAllocateVirtualMemory April 20, 2021, 9:18 a.m.	process_identifier: 8232 region_size: 618496 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00930000 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0xffffffff	1
NtProtectVirtualMemory April 20, 2021, 9:17 a.m.	process_identifier: 3388 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x72141000 process_handle: 0xffffffff	1
NtProtectVirtualMemory April 20, 2021, 9:18 a.m.	process_identifier: 3388 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 20480 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x7216d000 process_handle: 0xffffffff	1
NtAllocateVirtualMemory April 20, 2021, 9:18 a.m.	process_identifier: 3388 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00370000 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0xffffffff	1
NtAllocateVirtualMemory April 20, 2021, 9:18 a.m.	process_identifier: 3388 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00390000 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0xffffffff	1
NtAllocateVirtualMemory April 20, 2021, 9:18 a.m.	process_identifier: 3388 region_size: 618496 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00950000 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0xffffffff	1
NtProtectVirtualMemory April 20, 2021, 9:17 a.m.	process_identifier: 8400 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x72141000 process_handle: 0xffffffff	1
NtProtectVirtualMemory April 20, 2021, 9:18 a.m.	process_identifier: 8400 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 20480 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x7216d000 process_handle: 0xffffffff	1
NtAllocateVirtualMemory April 20, 2021, 9:18 a.m.	process_identifier: 8400 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00310000 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0xffffffff	1
NtAllocateVirtualMemory April 20, 2021, 9:18 a.m.	process_identifier: 8400 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00320000 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0xffffffff	1
NtAllocateVirtualMemory April 20, 2021, 9:18 a.m.	process_identifier: 8400 region_size: 618496 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00420000 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0xffffffff	1

File has been identified by 8 AntiVirus engines on VirusTotal as malicious (8 events)

Elastic	malicious (high confidence)
McAfee	Artemis!340994098DEB
ESET-NOD32	a variant of Generik.JLTUTKE
Avast	FileRepMalware
Paloalto	generic.ml
McAfee-GW-Edition	Artemis!Trojan
Webroot	W32.Trojan.Gen
AVG	FileRepMalware

Communicates with host for which no DNS query was performed (1 event)

host

172.217.25.14

g1mrfi.rar

Process Tree Toggle all

Network Toggle all

Suricata Toggle all

Suricata Alerts

Suricata TLS

Signatures Toggle All