Summary | ZeroBOX

Category	Machine	Started	Completed
FILE	s1_win7_x6402	April 24, 2021, 5:57 p.m.	April 24, 2021, 6:07 p.m.

Size	1.1MB
Type	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
MD5	`e6b7ec0dd1cd7b8f7c08ec2d4d369d8d`
SHA256	`eae537de7f5de3a3f3eb0b5021c78cc2e951186bf8411d045eab1ac9c6cc62f8`
CRC32	`EEA1BFE4`
ssdeep	`24576:Wr+fVBdzxo7RY/uuTkA+94dP2Qm4VltHR6bPYEH/e0HiD:e+fVBhxo7S/3Tn+94dP2Qm4VXxePYeHG`
PDB Path	c:\Wash\Lone\Engine\lea\Job O\bad.pdb
Yara	PE_Header_Zero - PE File Signature Zero OS_Processor_Check_Zero - OS Processor Check Signature Zero Win32_Trojan_Gen_2_0904B0_Zero - Win32 Trojan Gen IsPE32 - (no description) IsDLL - (no description) IsWindowsGUI - (no description) HasDebugData - DebugData Check win_files_operation - Affect private profile Win32_Trojan_Gen_1_0904B0_Zero - Win32 Trojan Emotet

rundll32.exe "C:\Windows\System32\rundll32.exe" C:\Users\test22\AppData\Local\Temp\bd4e3yw.tar.dll,Bearmass
5032
rundll32.exe "C:\Windows\System32\rundll32.exe" C:\Users\test22\AppData\Local\Temp\bd4e3yw.tar.dll,Caselist
7528
rundll32.exe "C:\Windows\System32\rundll32.exe" C:\Users\test22\AppData\Local\Temp\bd4e3yw.tar.dll,CommonWash
5656
rundll32.exe "C:\Windows\System32\rundll32.exe" C:\Users\test22\AppData\Local\Temp\bd4e3yw.tar.dll,Heregather
1160
rundll32.exe "C:\Windows\System32\rundll32.exe" C:\Users\test22\AppData\Local\Temp\bd4e3yw.tar.dll,Melodycross
7816
rundll32.exe "C:\Windows\System32\rundll32.exe" C:\Users\test22\AppData\Local\Temp\bd4e3yw.tar.dll,Woodgirl
6696
rundll32.exe "C:\Windows\System32\rundll32.exe" C:\Users\test22\AppData\Local\Temp\bd4e3yw.tar.dll,
6596

Name	Response	Post-Analysis Lookup
No hosts contacted.

IP Address	Status	Action
164.124.101.2	Active	Moloch
172.217.25.14	Active	Moloch

Suricata Alerts

No Suricata Alerts

Suricata TLS

No Suricata TLS

This executable has a PDB path (1 event)

pdb_path

c:\Wash\Lone\Engine\lea\Job O\bad.pdb

The executable contains unknown PE section names indicative of a packer (could be a false positive) (1 event)

section

.gfids

One or more processes crashed (50 out of 222 events)

Time & API	Arguments	Status
__exception__ April 24, 2021, 5:58 p.m.	stacktrace: exception.instruction_r: cc c3 5d c3 33 c0 5d c3 68 e0 7d b6 c0 68 ea b3 exception.instruction: int3 exception.exception_code: 0x80000003 exception.symbol: DllRegisterServer+0x72ec bd4e3yw+0x1105c exception.address: 0x7207105c registers.esp: 652364 registers.edi: 6302680 registers.eax: 2000478246 registers.ebp: 2000552521 registers.edx: 129161 registers.ebx: 2704346981 registers.esi: 1970405376 registers.ecx: 66040	1
__exception__ April 24, 2021, 5:58 p.m.	stacktrace: exception.instruction_r: cc c3 5d c3 33 c0 5d c3 68 e0 7d b6 c0 68 ea b3 exception.instruction: int3 exception.exception_code: 0x80000003 exception.symbol: DllRegisterServer+0x72ec bd4e3yw+0x1105c exception.address: 0x7207105c registers.esp: 652340 registers.edi: 16 registers.eax: 2000478246 registers.ebp: 34080720 registers.edx: 0 registers.ebx: 0 registers.esi: 64 registers.ecx: 0	1
__exception__ April 24, 2021, 5:58 p.m.	stacktrace: exception.instruction_r: cc c3 5d c3 33 c0 5d c3 68 e0 7d b6 c0 68 ea b3 exception.instruction: int3 exception.exception_code: 0x80000003 exception.symbol: DllRegisterServer+0x72ec bd4e3yw+0x1105c exception.address: 0x7207105c registers.esp: 652340 registers.edi: 15 registers.eax: 2000478246 registers.ebp: 34080736 registers.edx: 0 registers.ebx: 0 registers.esi: 64 registers.ecx: 0	1
__exception__ April 24, 2021, 5:58 p.m.	stacktrace: exception.instruction_r: cc c3 5d c3 33 c0 5d c3 68 e0 7d b6 c0 68 ea b3 exception.instruction: int3 exception.exception_code: 0x80000003 exception.symbol: DllRegisterServer+0x72ec bd4e3yw+0x1105c exception.address: 0x7207105c registers.esp: 652340 registers.edi: 14 registers.eax: 2000478246 registers.ebp: 34080752 registers.edx: 0 registers.ebx: 0 registers.esi: 64 registers.ecx: 0	1
__exception__ April 24, 2021, 5:58 p.m.	stacktrace: exception.instruction_r: cc c3 5d c3 33 c0 5d c3 68 e0 7d b6 c0 68 ea b3 exception.instruction: int3 exception.exception_code: 0x80000003 exception.symbol: DllRegisterServer+0x72ec bd4e3yw+0x1105c exception.address: 0x7207105c registers.esp: 652340 registers.edi: 13 registers.eax: 2000478246 registers.ebp: 34080768 registers.edx: 0 registers.ebx: 0 registers.esi: 64 registers.ecx: 0	1
__exception__ April 24, 2021, 5:58 p.m.	stacktrace: exception.instruction_r: cc c3 5d c3 33 c0 5d c3 68 e0 7d b6 c0 68 ea b3 exception.instruction: int3 exception.exception_code: 0x80000003 exception.symbol: DllRegisterServer+0x72ec bd4e3yw+0x1105c exception.address: 0x7207105c registers.esp: 652340 registers.edi: 12 registers.eax: 2000478246 registers.ebp: 34080784 registers.edx: 0 registers.ebx: 0 registers.esi: 64 registers.ecx: 0	1
__exception__ April 24, 2021, 5:58 p.m.	stacktrace: exception.instruction_r: cc c3 5d c3 33 c0 5d c3 68 e0 7d b6 c0 68 ea b3 exception.instruction: int3 exception.exception_code: 0x80000003 exception.symbol: DllRegisterServer+0x72ec bd4e3yw+0x1105c exception.address: 0x7207105c registers.esp: 652340 registers.edi: 11 registers.eax: 2000478246 registers.ebp: 34080800 registers.edx: 0 registers.ebx: 0 registers.esi: 64 registers.ecx: 0	1
__exception__ April 24, 2021, 5:58 p.m.	stacktrace: exception.instruction_r: cc c3 5d c3 33 c0 5d c3 68 e0 7d b6 c0 68 ea b3 exception.instruction: int3 exception.exception_code: 0x80000003 exception.symbol: DllRegisterServer+0x72ec bd4e3yw+0x1105c exception.address: 0x7207105c registers.esp: 652340 registers.edi: 10 registers.eax: 2000478246 registers.ebp: 34080816 registers.edx: 0 registers.ebx: 0 registers.esi: 64 registers.ecx: 0	1
__exception__ April 24, 2021, 5:58 p.m.	stacktrace: exception.instruction_r: cc c3 5d c3 33 c0 5d c3 68 e0 7d b6 c0 68 ea b3 exception.instruction: int3 exception.exception_code: 0x80000003 exception.symbol: DllRegisterServer+0x72ec bd4e3yw+0x1105c exception.address: 0x7207105c registers.esp: 652340 registers.edi: 9 registers.eax: 2000478246 registers.ebp: 34080832 registers.edx: 0 registers.ebx: 0 registers.esi: 64 registers.ecx: 0	1
__exception__ April 24, 2021, 5:58 p.m.	stacktrace: exception.instruction_r: cc c3 5d c3 33 c0 5d c3 68 e0 7d b6 c0 68 ea b3 exception.instruction: int3 exception.exception_code: 0x80000003 exception.symbol: DllRegisterServer+0x72ec bd4e3yw+0x1105c exception.address: 0x7207105c registers.esp: 652340 registers.edi: 8 registers.eax: 2000478246 registers.ebp: 34080848 registers.edx: 0 registers.ebx: 0 registers.esi: 64 registers.ecx: 0	1
__exception__ April 24, 2021, 5:58 p.m.	stacktrace: exception.instruction_r: cc c3 5d c3 33 c0 5d c3 68 e0 7d b6 c0 68 ea b3 exception.instruction: int3 exception.exception_code: 0x80000003 exception.symbol: DllRegisterServer+0x72ec bd4e3yw+0x1105c exception.address: 0x7207105c registers.esp: 652340 registers.edi: 7 registers.eax: 2000478246 registers.ebp: 34080864 registers.edx: 0 registers.ebx: 0 registers.esi: 64 registers.ecx: 0	1
__exception__ April 24, 2021, 5:58 p.m.	stacktrace: exception.instruction_r: cc c3 5d c3 33 c0 5d c3 68 e0 7d b6 c0 68 ea b3 exception.instruction: int3 exception.exception_code: 0x80000003 exception.symbol: DllRegisterServer+0x72ec bd4e3yw+0x1105c exception.address: 0x7207105c registers.esp: 652340 registers.edi: 6 registers.eax: 2000478246 registers.ebp: 34080880 registers.edx: 0 registers.ebx: 0 registers.esi: 64 registers.ecx: 0	1
__exception__ April 24, 2021, 5:58 p.m.	stacktrace: exception.instruction_r: cc c3 5d c3 33 c0 5d c3 68 e0 7d b6 c0 68 ea b3 exception.instruction: int3 exception.exception_code: 0x80000003 exception.symbol: DllRegisterServer+0x72ec bd4e3yw+0x1105c exception.address: 0x7207105c registers.esp: 652340 registers.edi: 5 registers.eax: 2000478246 registers.ebp: 34080896 registers.edx: 0 registers.ebx: 0 registers.esi: 64 registers.ecx: 0	1
__exception__ April 24, 2021, 5:58 p.m.	stacktrace: exception.instruction_r: cc c3 5d c3 33 c0 5d c3 68 e0 7d b6 c0 68 ea b3 exception.instruction: int3 exception.exception_code: 0x80000003 exception.symbol: DllRegisterServer+0x72ec bd4e3yw+0x1105c exception.address: 0x7207105c registers.esp: 652340 registers.edi: 4 registers.eax: 2000478246 registers.ebp: 34080912 registers.edx: 0 registers.ebx: 0 registers.esi: 64 registers.ecx: 0	1
__exception__ April 24, 2021, 5:58 p.m.	stacktrace: exception.instruction_r: cc c3 5d c3 33 c0 5d c3 68 e0 7d b6 c0 68 ea b3 exception.instruction: int3 exception.exception_code: 0x80000003 exception.symbol: DllRegisterServer+0x72ec bd4e3yw+0x1105c exception.address: 0x7207105c registers.esp: 652340 registers.edi: 3 registers.eax: 2000478246 registers.ebp: 34080928 registers.edx: 0 registers.ebx: 0 registers.esi: 64 registers.ecx: 0	1
__exception__ April 24, 2021, 5:58 p.m.	stacktrace: exception.instruction_r: cc c3 5d c3 33 c0 5d c3 68 e0 7d b6 c0 68 ea b3 exception.instruction: int3 exception.exception_code: 0x80000003 exception.symbol: DllRegisterServer+0x72ec bd4e3yw+0x1105c exception.address: 0x7207105c registers.esp: 652340 registers.edi: 2 registers.eax: 2000478246 registers.ebp: 34080944 registers.edx: 0 registers.ebx: 0 registers.esi: 64 registers.ecx: 0	1
__exception__ April 24, 2021, 5:58 p.m.	stacktrace: exception.instruction_r: cc c3 5d c3 33 c0 5d c3 68 e0 7d b6 c0 68 ea b3 exception.instruction: int3 exception.exception_code: 0x80000003 exception.symbol: DllRegisterServer+0x72ec bd4e3yw+0x1105c exception.address: 0x7207105c registers.esp: 652340 registers.edi: 1 registers.eax: 2000478246 registers.ebp: 34080960 registers.edx: 0 registers.ebx: 0 registers.esi: 64 registers.ecx: 0	1
__exception__ April 24, 2021, 5:58 p.m.	stacktrace: DllRegisterServer+0xcbc7 bd4e3yw+0x16937 @ 0x72076937 exception.instruction_r: cc c3 5d c3 33 c0 5d c3 68 e0 7d b6 c0 68 ea b3 exception.instruction: int3 exception.exception_code: 0x80000003 exception.symbol: DllRegisterServer+0x72ec bd4e3yw+0x1105c exception.address: 0x7207105c registers.esp: 651544 registers.edi: 12 registers.eax: 2000478246 registers.ebp: 652608 registers.edx: 23 registers.ebx: 652624 registers.esi: 23 registers.ecx: 0	1
__exception__ April 24, 2021, 5:58 p.m.	stacktrace: exception.instruction_r: cc c3 5d c3 33 c0 5d c3 68 e0 7d b6 c0 68 ea b3 exception.instruction: int3 exception.exception_code: 0x80000003 exception.symbol: DllRegisterServer+0x72ec bd4e3yw+0x1105c exception.address: 0x7207105c registers.esp: 652592 registers.edi: 6 registers.eax: 2000478246 registers.ebp: 96784 registers.edx: 827898 registers.ebx: 0 registers.esi: 282 registers.ecx: 0	1
__exception__ April 24, 2021, 5:58 p.m.	stacktrace: exception.instruction_r: cc c3 5d c3 33 c0 5d c3 68 e0 7d b6 c0 68 ea b3 exception.instruction: int3 exception.exception_code: 0x80000003 exception.symbol: DllRegisterServer+0x72ec bd4e3yw+0x1105c exception.address: 0x7207105c registers.esp: 652568 registers.edi: 6 registers.eax: 2000478246 registers.ebp: 16 registers.edx: 0 registers.ebx: 64 registers.esi: 34084200 registers.ecx: 0	1
__exception__ April 24, 2021, 5:58 p.m.	stacktrace: exception.instruction_r: cc c3 5d c3 33 c0 5d c3 68 e0 7d b6 c0 68 ea b3 exception.instruction: int3 exception.exception_code: 0x80000003 exception.symbol: DllRegisterServer+0x72ec bd4e3yw+0x1105c exception.address: 0x7207105c registers.esp: 652568 registers.edi: 6 registers.eax: 2000478246 registers.ebp: 15 registers.edx: 0 registers.ebx: 64 registers.esi: 34084224 registers.ecx: 0	1
__exception__ April 24, 2021, 5:58 p.m.	stacktrace: exception.instruction_r: cc c3 5d c3 33 c0 5d c3 68 e0 7d b6 c0 68 ea b3 exception.instruction: int3 exception.exception_code: 0x80000003 exception.symbol: DllRegisterServer+0x72ec bd4e3yw+0x1105c exception.address: 0x7207105c registers.esp: 652568 registers.edi: 6 registers.eax: 2000478246 registers.ebp: 14 registers.edx: 0 registers.ebx: 64 registers.esi: 34084248 registers.ecx: 0	1
__exception__ April 24, 2021, 5:58 p.m.	stacktrace: exception.instruction_r: cc c3 5d c3 33 c0 5d c3 68 e0 7d b6 c0 68 ea b3 exception.instruction: int3 exception.exception_code: 0x80000003 exception.symbol: DllRegisterServer+0x72ec bd4e3yw+0x1105c exception.address: 0x7207105c registers.esp: 652568 registers.edi: 6 registers.eax: 2000478246 registers.ebp: 13 registers.edx: 0 registers.ebx: 64 registers.esi: 34084272 registers.ecx: 0	1
__exception__ April 24, 2021, 5:58 p.m.	stacktrace: exception.instruction_r: cc c3 5d c3 33 c0 5d c3 68 e0 7d b6 c0 68 ea b3 exception.instruction: int3 exception.exception_code: 0x80000003 exception.symbol: DllRegisterServer+0x72ec bd4e3yw+0x1105c exception.address: 0x7207105c registers.esp: 652568 registers.edi: 6 registers.eax: 2000478246 registers.ebp: 12 registers.edx: 0 registers.ebx: 64 registers.esi: 34084296 registers.ecx: 0	1
__exception__ April 24, 2021, 5:58 p.m.	stacktrace: exception.instruction_r: cc c3 5d c3 33 c0 5d c3 68 e0 7d b6 c0 68 ea b3 exception.instruction: int3 exception.exception_code: 0x80000003 exception.symbol: DllRegisterServer+0x72ec bd4e3yw+0x1105c exception.address: 0x7207105c registers.esp: 652568 registers.edi: 6 registers.eax: 2000478246 registers.ebp: 11 registers.edx: 0 registers.ebx: 64 registers.esi: 34084320 registers.ecx: 0	1
__exception__ April 24, 2021, 5:58 p.m.	stacktrace: exception.instruction_r: cc c3 5d c3 33 c0 5d c3 68 e0 7d b6 c0 68 ea b3 exception.instruction: int3 exception.exception_code: 0x80000003 exception.symbol: DllRegisterServer+0x72ec bd4e3yw+0x1105c exception.address: 0x7207105c registers.esp: 652568 registers.edi: 6 registers.eax: 2000478246 registers.ebp: 10 registers.edx: 0 registers.ebx: 64 registers.esi: 34084344 registers.ecx: 0	1
__exception__ April 24, 2021, 5:58 p.m.	stacktrace: exception.instruction_r: cc c3 5d c3 33 c0 5d c3 68 e0 7d b6 c0 68 ea b3 exception.instruction: int3 exception.exception_code: 0x80000003 exception.symbol: DllRegisterServer+0x72ec bd4e3yw+0x1105c exception.address: 0x7207105c registers.esp: 652568 registers.edi: 6 registers.eax: 2000478246 registers.ebp: 9 registers.edx: 0 registers.ebx: 64 registers.esi: 34084368 registers.ecx: 0	1
__exception__ April 24, 2021, 5:58 p.m.	stacktrace: exception.instruction_r: cc c3 5d c3 33 c0 5d c3 68 e0 7d b6 c0 68 ea b3 exception.instruction: int3 exception.exception_code: 0x80000003 exception.symbol: DllRegisterServer+0x72ec bd4e3yw+0x1105c exception.address: 0x7207105c registers.esp: 652568 registers.edi: 6 registers.eax: 2000478246 registers.ebp: 8 registers.edx: 0 registers.ebx: 64 registers.esi: 34084392 registers.ecx: 0	1
__exception__ April 24, 2021, 5:58 p.m.	stacktrace: exception.instruction_r: cc c3 5d c3 33 c0 5d c3 68 e0 7d b6 c0 68 ea b3 exception.instruction: int3 exception.exception_code: 0x80000003 exception.symbol: DllRegisterServer+0x72ec bd4e3yw+0x1105c exception.address: 0x7207105c registers.esp: 652568 registers.edi: 6 registers.eax: 2000478246 registers.ebp: 7 registers.edx: 0 registers.ebx: 64 registers.esi: 34084416 registers.ecx: 0	1
__exception__ April 24, 2021, 5:58 p.m.	stacktrace: exception.instruction_r: cc c3 5d c3 33 c0 5d c3 68 e0 7d b6 c0 68 ea b3 exception.instruction: int3 exception.exception_code: 0x80000003 exception.symbol: DllRegisterServer+0x72ec bd4e3yw+0x1105c exception.address: 0x7207105c registers.esp: 652568 registers.edi: 6 registers.eax: 2000478246 registers.ebp: 6 registers.edx: 0 registers.ebx: 64 registers.esi: 34084440 registers.ecx: 0	1
__exception__ April 24, 2021, 5:58 p.m.	stacktrace: exception.instruction_r: cc c3 5d c3 33 c0 5d c3 68 e0 7d b6 c0 68 ea b3 exception.instruction: int3 exception.exception_code: 0x80000003 exception.symbol: DllRegisterServer+0x72ec bd4e3yw+0x1105c exception.address: 0x7207105c registers.esp: 652568 registers.edi: 6 registers.eax: 2000478246 registers.ebp: 5 registers.edx: 0 registers.ebx: 64 registers.esi: 34084464 registers.ecx: 0	1
__exception__ April 24, 2021, 5:58 p.m.	stacktrace: exception.instruction_r: cc c3 5d c3 33 c0 5d c3 68 e0 7d b6 c0 68 ea b3 exception.instruction: int3 exception.exception_code: 0x80000003 exception.symbol: DllRegisterServer+0x72ec bd4e3yw+0x1105c exception.address: 0x7207105c registers.esp: 652568 registers.edi: 6 registers.eax: 2000478246 registers.ebp: 4 registers.edx: 0 registers.ebx: 64 registers.esi: 34084488 registers.ecx: 0	1
__exception__ April 24, 2021, 5:58 p.m.	stacktrace: exception.instruction_r: cc c3 5d c3 33 c0 5d c3 68 e0 7d b6 c0 68 ea b3 exception.instruction: int3 exception.exception_code: 0x80000003 exception.symbol: DllRegisterServer+0x72ec bd4e3yw+0x1105c exception.address: 0x7207105c registers.esp: 652568 registers.edi: 6 registers.eax: 2000478246 registers.ebp: 3 registers.edx: 0 registers.ebx: 64 registers.esi: 34084512 registers.ecx: 0	1
__exception__ April 24, 2021, 5:58 p.m.	stacktrace: exception.instruction_r: cc c3 5d c3 33 c0 5d c3 68 e0 7d b6 c0 68 ea b3 exception.instruction: int3 exception.exception_code: 0x80000003 exception.symbol: DllRegisterServer+0x72ec bd4e3yw+0x1105c exception.address: 0x7207105c registers.esp: 652568 registers.edi: 6 registers.eax: 2000478246 registers.ebp: 2 registers.edx: 0 registers.ebx: 64 registers.esi: 34084536 registers.ecx: 0	1
__exception__ April 24, 2021, 5:58 p.m.	stacktrace: exception.instruction_r: cc c3 5d c3 33 c0 5d c3 68 e0 7d b6 c0 68 ea b3 exception.instruction: int3 exception.exception_code: 0x80000003 exception.symbol: DllRegisterServer+0x72ec bd4e3yw+0x1105c exception.address: 0x7207105c registers.esp: 652568 registers.edi: 6 registers.eax: 2000478246 registers.ebp: 1 registers.edx: 0 registers.ebx: 64 registers.esi: 34084560 registers.ecx: 0	1
__exception__ April 24, 2021, 5:58 p.m.	stacktrace: RtlUlonglongByteSwap+0x7a9 RtlFreeOemString-0x21131 ntdll+0x7db99 @ 0x7741db99 WinSqmAddToStreamEx+0x5e8 RtlDestroyMemoryZone-0x1c7 ntdll+0x6c0fc @ 0x7740c0fc LdrUnloadDll+0x4a RtlDosPathNameToRelativeNtPathName_U-0x419 ntdll+0x41221 @ 0x773e1221 New_ntdll_LdrUnloadDll@4+0x94 New_ntdll_NtAllocateVirtualMemory@24-0xc2 @ 0x729bd61a FreeLibrary+0x15 GetModuleFileNameA-0x7d kernelbase+0x11da7 @ 0x76a81da7 rundll32+0x24b0 @ 0x7824b0 rundll32+0x12e8 @ 0x7812e8 rundll32+0x1901 @ 0x781901 BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x757333ca RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x773d9ed2 RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x773d9ea5 exception.symbol: exception.exception_code: 0xc0000005 exception.address: 0xade8cb8b registers.esp: 653828 registers.edi: 6302552 registers.eax: 0 registers.ebp: 653856 registers.edx: 2001346688 registers.ebx: 2917714827 registers.esi: 653844 registers.ecx: 17	1
__exception__ April 24, 2021, 5:58 p.m.	stacktrace: exception.instruction_r: cc c3 8b 47 04 ff 80 b8 00 00 00 8b 57 04 83 82 exception.instruction: int3 exception.exception_code: 0x80000003 exception.symbol: DllRegisterServer+0xe072 bd4e3yw+0x17de2 exception.address: 0x72077de2 registers.esp: 652068 registers.edi: 652104 registers.eax: 1970591746 registers.ebp: 1970405376 registers.edx: 115 registers.ebx: 6320648 registers.esi: 2001356580 registers.ecx: 16	1
__exception__ April 24, 2021, 5:58 p.m.	stacktrace: exception.instruction_r: cc c3 5d c3 33 c0 5d c3 68 e0 7d b6 c0 68 ea b3 exception.instruction: int3 exception.exception_code: 0x80000003 exception.symbol: DllRegisterServer+0x72ec bd4e3yw+0x1105c exception.address: 0x7207105c registers.esp: 2028776 registers.edi: 4467672 registers.eax: 2000478246 registers.ebp: 2000552521 registers.edx: 129161 registers.ebx: 2704346981 registers.esi: 1970405376 registers.ecx: 66040	1
__exception__ April 24, 2021, 5:58 p.m.	stacktrace: exception.instruction_r: cc c3 5d c3 33 c0 5d c3 68 e0 7d b6 c0 68 ea b3 exception.instruction: int3 exception.exception_code: 0x80000003 exception.symbol: DllRegisterServer+0x72ec bd4e3yw+0x1105c exception.address: 0x7207105c registers.esp: 2028752 registers.edi: 16 registers.eax: 2000478246 registers.ebp: 33687504 registers.edx: 0 registers.ebx: 0 registers.esi: 64 registers.ecx: 0	1
__exception__ April 24, 2021, 5:58 p.m.	stacktrace: exception.instruction_r: cc c3 5d c3 33 c0 5d c3 68 e0 7d b6 c0 68 ea b3 exception.instruction: int3 exception.exception_code: 0x80000003 exception.symbol: DllRegisterServer+0x72ec bd4e3yw+0x1105c exception.address: 0x7207105c registers.esp: 2028752 registers.edi: 15 registers.eax: 2000478246 registers.ebp: 33687520 registers.edx: 0 registers.ebx: 0 registers.esi: 64 registers.ecx: 0	1
__exception__ April 24, 2021, 5:58 p.m.	stacktrace: exception.instruction_r: cc c3 5d c3 33 c0 5d c3 68 e0 7d b6 c0 68 ea b3 exception.instruction: int3 exception.exception_code: 0x80000003 exception.symbol: DllRegisterServer+0x72ec bd4e3yw+0x1105c exception.address: 0x7207105c registers.esp: 2028752 registers.edi: 14 registers.eax: 2000478246 registers.ebp: 33687536 registers.edx: 0 registers.ebx: 0 registers.esi: 64 registers.ecx: 0	1
__exception__ April 24, 2021, 5:58 p.m.	stacktrace: exception.instruction_r: cc c3 5d c3 33 c0 5d c3 68 e0 7d b6 c0 68 ea b3 exception.instruction: int3 exception.exception_code: 0x80000003 exception.symbol: DllRegisterServer+0x72ec bd4e3yw+0x1105c exception.address: 0x7207105c registers.esp: 2028752 registers.edi: 13 registers.eax: 2000478246 registers.ebp: 33687552 registers.edx: 0 registers.ebx: 0 registers.esi: 64 registers.ecx: 0	1
__exception__ April 24, 2021, 5:58 p.m.	stacktrace: exception.instruction_r: cc c3 5d c3 33 c0 5d c3 68 e0 7d b6 c0 68 ea b3 exception.instruction: int3 exception.exception_code: 0x80000003 exception.symbol: DllRegisterServer+0x72ec bd4e3yw+0x1105c exception.address: 0x7207105c registers.esp: 2028752 registers.edi: 12 registers.eax: 2000478246 registers.ebp: 33687568 registers.edx: 0 registers.ebx: 0 registers.esi: 64 registers.ecx: 0	1
__exception__ April 24, 2021, 5:58 p.m.	stacktrace: exception.instruction_r: cc c3 5d c3 33 c0 5d c3 68 e0 7d b6 c0 68 ea b3 exception.instruction: int3 exception.exception_code: 0x80000003 exception.symbol: DllRegisterServer+0x72ec bd4e3yw+0x1105c exception.address: 0x7207105c registers.esp: 2028752 registers.edi: 11 registers.eax: 2000478246 registers.ebp: 33687584 registers.edx: 0 registers.ebx: 0 registers.esi: 64 registers.ecx: 0	1
__exception__ April 24, 2021, 5:58 p.m.	stacktrace: exception.instruction_r: cc c3 5d c3 33 c0 5d c3 68 e0 7d b6 c0 68 ea b3 exception.instruction: int3 exception.exception_code: 0x80000003 exception.symbol: DllRegisterServer+0x72ec bd4e3yw+0x1105c exception.address: 0x7207105c registers.esp: 2028752 registers.edi: 10 registers.eax: 2000478246 registers.ebp: 33687600 registers.edx: 0 registers.ebx: 0 registers.esi: 64 registers.ecx: 0	1
__exception__ April 24, 2021, 5:58 p.m.	stacktrace: exception.instruction_r: cc c3 5d c3 33 c0 5d c3 68 e0 7d b6 c0 68 ea b3 exception.instruction: int3 exception.exception_code: 0x80000003 exception.symbol: DllRegisterServer+0x72ec bd4e3yw+0x1105c exception.address: 0x7207105c registers.esp: 2028752 registers.edi: 9 registers.eax: 2000478246 registers.ebp: 33687616 registers.edx: 0 registers.ebx: 0 registers.esi: 64 registers.ecx: 0	1
__exception__ April 24, 2021, 5:58 p.m.	stacktrace: exception.instruction_r: cc c3 5d c3 33 c0 5d c3 68 e0 7d b6 c0 68 ea b3 exception.instruction: int3 exception.exception_code: 0x80000003 exception.symbol: DllRegisterServer+0x72ec bd4e3yw+0x1105c exception.address: 0x7207105c registers.esp: 2028752 registers.edi: 8 registers.eax: 2000478246 registers.ebp: 33687632 registers.edx: 0 registers.ebx: 0 registers.esi: 64 registers.ecx: 0	1
__exception__ April 24, 2021, 5:58 p.m.	stacktrace: exception.instruction_r: cc c3 5d c3 33 c0 5d c3 68 e0 7d b6 c0 68 ea b3 exception.instruction: int3 exception.exception_code: 0x80000003 exception.symbol: DllRegisterServer+0x72ec bd4e3yw+0x1105c exception.address: 0x7207105c registers.esp: 2028752 registers.edi: 7 registers.eax: 2000478246 registers.ebp: 33687648 registers.edx: 0 registers.ebx: 0 registers.esi: 64 registers.ecx: 0	1
__exception__ April 24, 2021, 5:58 p.m.	stacktrace: exception.instruction_r: cc c3 5d c3 33 c0 5d c3 68 e0 7d b6 c0 68 ea b3 exception.instruction: int3 exception.exception_code: 0x80000003 exception.symbol: DllRegisterServer+0x72ec bd4e3yw+0x1105c exception.address: 0x7207105c registers.esp: 2028752 registers.edi: 6 registers.eax: 2000478246 registers.ebp: 33687664 registers.edx: 0 registers.ebx: 0 registers.esi: 64 registers.ecx: 0	1
__exception__ April 24, 2021, 5:58 p.m.	stacktrace: exception.instruction_r: cc c3 5d c3 33 c0 5d c3 68 e0 7d b6 c0 68 ea b3 exception.instruction: int3 exception.exception_code: 0x80000003 exception.symbol: DllRegisterServer+0x72ec bd4e3yw+0x1105c exception.address: 0x7207105c registers.esp: 2028752 registers.edi: 5 registers.eax: 2000478246 registers.ebp: 33687680 registers.edx: 0 registers.ebx: 0 registers.esi: 64 registers.ecx: 0	1

Allocates read-write-execute memory (usually to unpack itself) (30 events)

Time & API	Arguments	Status
NtProtectVirtualMemory April 24, 2021, 5:57 p.m.	process_identifier: 5032 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x7217e000 process_handle: 0xffffffff	1
NtProtectVirtualMemory April 24, 2021, 5:58 p.m.	process_identifier: 5032 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 16384 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x72168000 process_handle: 0xffffffff	1
NtAllocateVirtualMemory April 24, 2021, 5:58 p.m.	process_identifier: 5032 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00300000 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0xffffffff	1
NtAllocateVirtualMemory April 24, 2021, 5:58 p.m.	process_identifier: 5032 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00320000 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0xffffffff	1
NtAllocateVirtualMemory April 24, 2021, 5:58 p.m.	process_identifier: 5032 region_size: 589824 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x006d0000 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0xffffffff	1
NtProtectVirtualMemory April 24, 2021, 5:57 p.m.	process_identifier: 7528 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x7217e000 process_handle: 0xffffffff	1
NtProtectVirtualMemory April 24, 2021, 5:58 p.m.	process_identifier: 7528 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 16384 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x72168000 process_handle: 0xffffffff	1
NtAllocateVirtualMemory April 24, 2021, 5:58 p.m.	process_identifier: 7528 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00380000 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0xffffffff	1
NtAllocateVirtualMemory April 24, 2021, 5:58 p.m.	process_identifier: 7528 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00390000 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0xffffffff	1
NtAllocateVirtualMemory April 24, 2021, 5:58 p.m.	process_identifier: 7528 region_size: 589824 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x01d20000 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0xffffffff	1
NtProtectVirtualMemory April 24, 2021, 5:57 p.m.	process_identifier: 5656 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x7217e000 process_handle: 0xffffffff	1
NtProtectVirtualMemory April 24, 2021, 5:58 p.m.	process_identifier: 5656 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 16384 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x72168000 process_handle: 0xffffffff	1
NtAllocateVirtualMemory April 24, 2021, 5:58 p.m.	process_identifier: 5656 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x004b0000 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0xffffffff	1
NtAllocateVirtualMemory April 24, 2021, 5:58 p.m.	process_identifier: 5656 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x004c0000 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0xffffffff	1
NtAllocateVirtualMemory April 24, 2021, 5:58 p.m.	process_identifier: 5656 region_size: 589824 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00520000 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0xffffffff	1
NtProtectVirtualMemory April 24, 2021, 5:57 p.m.	process_identifier: 1160 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x7217e000 process_handle: 0xffffffff	1
NtProtectVirtualMemory April 24, 2021, 5:58 p.m.	process_identifier: 1160 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 16384 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x72168000 process_handle: 0xffffffff	1
NtAllocateVirtualMemory April 24, 2021, 5:58 p.m.	process_identifier: 1160 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x002f0000 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0xffffffff	1
NtAllocateVirtualMemory April 24, 2021, 5:58 p.m.	process_identifier: 1160 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00300000 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0xffffffff	1
NtAllocateVirtualMemory April 24, 2021, 5:58 p.m.	process_identifier: 1160 region_size: 589824 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00410000 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0xffffffff	1
NtProtectVirtualMemory April 24, 2021, 5:57 p.m.	process_identifier: 7816 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x7217e000 process_handle: 0xffffffff	1
NtProtectVirtualMemory April 24, 2021, 5:58 p.m.	process_identifier: 7816 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 16384 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x72168000 process_handle: 0xffffffff	1
NtAllocateVirtualMemory April 24, 2021, 5:58 p.m.	process_identifier: 7816 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00340000 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0xffffffff	1
NtAllocateVirtualMemory April 24, 2021, 5:58 p.m.	process_identifier: 7816 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00350000 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0xffffffff	1
NtAllocateVirtualMemory April 24, 2021, 5:58 p.m.	process_identifier: 7816 region_size: 589824 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x01d20000 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0xffffffff	1
NtProtectVirtualMemory April 24, 2021, 5:57 p.m.	process_identifier: 6696 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x7217e000 process_handle: 0xffffffff	1
NtProtectVirtualMemory April 24, 2021, 5:58 p.m.	process_identifier: 6696 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 16384 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x72168000 process_handle: 0xffffffff	1
NtAllocateVirtualMemory April 24, 2021, 5:58 p.m.	process_identifier: 6696 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00470000 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0xffffffff	1
NtAllocateVirtualMemory April 24, 2021, 5:58 p.m.	process_identifier: 6696 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00480000 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0xffffffff	1
NtAllocateVirtualMemory April 24, 2021, 5:58 p.m.	process_identifier: 6696 region_size: 589824 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00500000 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0xffffffff	1

Communicates with host for which no DNS query was performed (1 event)

host

172.217.25.14

File has been identified by 34 AntiVirus engines on VirusTotal as malicious (34 events)

Elastic	malicious (high confidence)
MicroWorld-eScan	Trojan.GenericKD.46139299
FireEye	Trojan.GenericKD.46139299
ALYac	Trojan.GenericKD.46139299
Sangfor	Riskware.Win32.Wacapew.C
K7AntiVirus	Trojan ( 0057b2861 )
K7GW	Trojan ( 0057b2861 )
CrowdStrike	win/malicious_confidence_100% (W)
Arcabit	Trojan.Generic.D2C007A3
Cyren	W32/Dridex.DA.gen!Eldorado
Symantec	Trojan.Gen.2
ESET-NOD32	a variant of Win32/Kryptik.HKMI
Avast	Win32:MalwareX-gen [Trj]
Kaspersky	HEUR:Trojan-Banker.Win32.Cridex.gen
BitDefender	Trojan.GenericKD.46139299
Rising	Trojan.Kryptik!8.8 (CLOUD)
Ad-Aware	Trojan.GenericKD.46139299
Emsisoft	Trojan.Crypt (A)
VIPRE	Trojan.Win32.Generic!BT
McAfee-GW-Edition	Trojan-FTJT!E6B7EC0DD1CD
Sophos	Mal/Generic-S
Avira	TR/AD.Dridex.jwqch
Kingsoft	Win32.Troj.Banker.(kcloud)
Microsoft	Trojan:Script/Phonzy.B!ml
AegisLab	Trojan.Win32.Cridex.7!c
GData	Trojan.GenericKD.46139299
AhnLab-V3	Trojan/Win.DRIDEX.C4433021
McAfee	Trojan-FTJT!E6B7EC0DD1CD
MAX	malware (ai score=86)
Malwarebytes	Trojan.Dridex
TrendMicro-HouseCall	TrojanSpy.Win32.DRIDEX.TIAOABDQ
Fortinet	W32/Kryptik.HKMI!tr
Webroot	W32.Malware.Gen
AVG	Win32:MalwareX-gen [Trj]

bd4e3yw.tar

Process Tree Toggle all

Network Toggle all

Suricata Toggle all

Suricata Alerts

Suricata TLS

Signatures Toggle All