Summary | ZeroBOX

Category	Machine	Started	Completed
FILE	s1_win7_x6402	April 28, 2021, 9:41 a.m.	April 28, 2021, 9:44 a.m.

Size	822.0KB
Type	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
MD5	`3bbac698f5c61fdd41a04d6b47d46b5c`
SHA256	`3c0bc20be866d4a0156f5b1ebb5418e9e58b65f292f4defbde0052644ca2c0e9`
CRC32	`7713136A`
ssdeep	`24576:4myuKoNJLA68C26QDG0B2sMXfrHEAo1gu54pdBBBBBj:QeJLA68C26X0VMXfbEAoV4pdBBBBBj`
PDB Path	c:\trip\Flat\367\Low\Line b\help.pdb
Yara	Win32_Trojan_Gen_2_0904B0_Zero - Win32 Trojan Gen IsPE32 - (no description) IsDLL - (no description) IsWindowsGUI - (no description) HasDebugData - DebugData Check PE_Header_Zero - PE File Signature Zero OS_Processor_Check_Zero - OS Processor Check Signature Zero win_files_operation - Affect private profile Win32_Trojan_Gen_1_0904B0_Zero - Win32 Trojan Emotet

rundll32.exe "C:\Windows\System32\rundll32.exe" C:\Users\test22\AppData\Local\Temp\presentation.dll,Artspoke
5580
- cmd.exe C:\Windows\system32\cmd.exe /c echo flo
  7688
rundll32.exe "C:\Windows\System32\rundll32.exe" C:\Users\test22\AppData\Local\Temp\presentation.dll,Endinstant
6988
- cmd.exe C:\Windows\system32\cmd.exe /c echo flo
  2776
rundll32.exe "C:\Windows\System32\rundll32.exe" C:\Users\test22\AppData\Local\Temp\presentation.dll,Evensolve
8780
- cmd.exe C:\Windows\system32\cmd.exe /c echo flo
  6200
rundll32.exe "C:\Windows\System32\rundll32.exe" C:\Users\test22\AppData\Local\Temp\presentation.dll,Footwinte2
4960
- cmd.exe C:\Windows\system32\cmd.exe /c echo flo
  4408
rundll32.exe "C:\Windows\System32\rundll32.exe" C:\Users\test22\AppData\Local\Temp\presentation.dll,Languagework
668
- cmd.exe C:\Windows\system32\cmd.exe /c echo flo
  2196
rundll32.exe "C:\Windows\System32\rundll32.exe" C:\Users\test22\AppData\Local\Temp\presentation.dll,
6912

Name	Response	Post-Analysis Lookup
app3.maintorna.com	A 34.73.201.12	34.73.201.12

IP Address	Status	Action
164.124.101.2	Active	Moloch
172.217.25.14	Active	Moloch
34.73.201.12	Active	Moloch

Suricata Alerts

Flow	SID	Signature	Category
TCP 34.73.201.12:80 -> 192.168.56.102:49831	2221010	SURICATA HTTP unable to match response to request	Generic Protocol Command Decode

Suricata TLS

No Suricata TLS

Queries for the computername (9 events)

Time & API	Arguments	Status	Return
GetComputerNameW April 28, 2021, 9:43 a.m.	computer_name:		0
GetComputerNameW April 28, 2021, 9:43 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameW April 28, 2021, 9:43 a.m.	computer_name:		0
GetComputerNameW April 28, 2021, 9:43 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameW April 28, 2021, 9:43 a.m.	computer_name:		0
GetComputerNameW April 28, 2021, 9:43 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameW April 28, 2021, 9:43 a.m.	computer_name:		0
GetComputerNameW April 28, 2021, 9:43 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameW April 28, 2021, 9:43 a.m.	computer_name: TEST22-PC	1	1

Command line console output was observed (5 events)

Time & API	Arguments	Status	Return
WriteConsoleW April 28, 2021, 9:41 a.m.	buffer: flo console_handle: 0x00000007	1	1
WriteConsoleW April 28, 2021, 9:41 a.m.	buffer: flo console_handle: 0x00000007	1	1
WriteConsoleW April 28, 2021, 9:41 a.m.	buffer: flo console_handle: 0x00000007	1	1
WriteConsoleW April 28, 2021, 9:41 a.m.	buffer: flo console_handle: 0x00000007	1	1
WriteConsoleW April 28, 2021, 9:42 a.m.	buffer: flo console_handle: 0x00000007	1	1

Collects information to fingerprint the system (MachineGuid, DigitalProductId, SystemBiosDate) (1 event)

registry

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\InstallDate

This executable has a PDB path (1 event)

pdb_path

c:\trip\Flat\367\Low\Line b\help.pdb

Performs some HTTP requests (1 event)

request

GET http://app3.maintorna.com/G30qB58Kk2/BU_2BdgootvFojVON/GZxWNJv1w2ZM/4TW3i3gbDXc/os7U_2B8OYn6Dx/FEJ4_2BXEIYp_2BEtAMOP/FkcnRwmFEGGLN6fE/En2P_2FLKoUyhE5/TcKe5GQI9jDgWmXX7z/9599_2BX4/OH7farLhbSxl3_2BzF7h/akWBEFH1XsZFliYBlra/6GWzvwhnXBMUJdDpd9lvat/nm8MP0jcJ6aC8/MERMX3tw/AT58JGbkfHN7cwZMJmYhvz9/RfVzMTVDXH/Gu_2FcyyAGu1Hwffc/7P_2BbsrgTm0/byY8mc1tE0Q/LLbpnzIiY_2FqI/X3m2IGAM39NOMPW7DXGQM/EAgQMq3

Allocates read-write-execute memory (usually to unpack itself) (33 events)

Time & API	Arguments	Status
NtProtectVirtualMemory April 28, 2021, 9:41 a.m.	process_identifier: 5580 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x72279000 process_handle: 0xffffffff	1
NtProtectVirtualMemory April 28, 2021, 9:42 a.m.	process_identifier: 5580 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 16384 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x722aa000 process_handle: 0xffffffff	1
NtAllocateVirtualMemory April 28, 2021, 9:42 a.m.	process_identifier: 5580 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x003a0000 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0xffffffff	1
NtAllocateVirtualMemory April 28, 2021, 9:42 a.m.	process_identifier: 5580 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x003b0000 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0xffffffff	1
NtAllocateVirtualMemory April 28, 2021, 9:42 a.m.	process_identifier: 5580 region_size: 151552 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x007e0000 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0xffffffff	1
NtProtectVirtualMemory April 28, 2021, 9:42 a.m.	process_identifier: 5580 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x73801000 process_handle: 0xffffffff	1
NtProtectVirtualMemory April 28, 2021, 9:42 a.m.	process_identifier: 5580 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x72c61000 process_handle: 0xffffffff	1
NtProtectVirtualMemory April 28, 2021, 9:41 a.m.	process_identifier: 6988 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x72279000 process_handle: 0xffffffff	1
NtProtectVirtualMemory April 28, 2021, 9:43 a.m.	process_identifier: 6988 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 16384 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x722aa000 process_handle: 0xffffffff	1
NtAllocateVirtualMemory April 28, 2021, 9:43 a.m.	process_identifier: 6988 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x007f0000 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0xffffffff	1
NtAllocateVirtualMemory April 28, 2021, 9:43 a.m.	process_identifier: 6988 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00800000 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0xffffffff	1
NtAllocateVirtualMemory April 28, 2021, 9:43 a.m.	process_identifier: 6988 region_size: 151552 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00810000 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0xffffffff	1
NtProtectVirtualMemory April 28, 2021, 9:43 a.m.	process_identifier: 6988 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x73801000 process_handle: 0xffffffff	1
NtProtectVirtualMemory April 28, 2021, 9:43 a.m.	process_identifier: 6988 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x72c61000 process_handle: 0xffffffff	1
NtProtectVirtualMemory April 28, 2021, 9:41 a.m.	process_identifier: 8780 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x72279000 process_handle: 0xffffffff	1
NtProtectVirtualMemory April 28, 2021, 9:42 a.m.	process_identifier: 8780 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 16384 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x722aa000 process_handle: 0xffffffff	1
NtAllocateVirtualMemory April 28, 2021, 9:42 a.m.	process_identifier: 8780 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x003e0000 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0xffffffff	1
NtAllocateVirtualMemory April 28, 2021, 9:42 a.m.	process_identifier: 8780 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x003f0000 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0xffffffff	1
NtAllocateVirtualMemory April 28, 2021, 9:42 a.m.	process_identifier: 8780 region_size: 151552 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00400000 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0xffffffff	1
NtProtectVirtualMemory April 28, 2021, 9:42 a.m.	process_identifier: 8780 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x73801000 process_handle: 0xffffffff	1
NtProtectVirtualMemory April 28, 2021, 9:42 a.m.	process_identifier: 8780 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x72c61000 process_handle: 0xffffffff	1
NtProtectVirtualMemory April 28, 2021, 9:41 a.m.	process_identifier: 4960 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x72279000 process_handle: 0xffffffff	1
NtProtectVirtualMemory April 28, 2021, 9:42 a.m.	process_identifier: 4960 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 16384 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x722aa000 process_handle: 0xffffffff	1
NtAllocateVirtualMemory April 28, 2021, 9:42 a.m.	process_identifier: 4960 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x007b0000 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0xffffffff	1
NtAllocateVirtualMemory April 28, 2021, 9:42 a.m.	process_identifier: 4960 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x007c0000 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0xffffffff	1
NtAllocateVirtualMemory April 28, 2021, 9:42 a.m.	process_identifier: 4960 region_size: 151552 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x007d0000 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0xffffffff	1
NtProtectVirtualMemory April 28, 2021, 9:43 a.m.	process_identifier: 4960 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x73801000 process_handle: 0xffffffff	1
NtProtectVirtualMemory April 28, 2021, 9:43 a.m.	process_identifier: 4960 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x72c61000 process_handle: 0xffffffff	1
NtProtectVirtualMemory April 28, 2021, 9:41 a.m.	process_identifier: 668 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x72279000 process_handle: 0xffffffff	1
NtProtectVirtualMemory April 28, 2021, 9:43 a.m.	process_identifier: 668 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 16384 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x722aa000 process_handle: 0xffffffff	1
NtAllocateVirtualMemory April 28, 2021, 9:43 a.m.	process_identifier: 668 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x003d0000 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0xffffffff	1
NtAllocateVirtualMemory April 28, 2021, 9:43 a.m.	process_identifier: 668 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x003e0000 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0xffffffff	1
NtAllocateVirtualMemory April 28, 2021, 9:43 a.m.	process_identifier: 668 region_size: 151552 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x003f0000 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0xffffffff	1

A process attempted to delay the analysis task. (1 event)

description

rundll32.exe tried to sleep 121 seconds, actually delayed analysis time by 121 seconds

Creates a suspicious process (1 event)

cmdline

C:\Windows\system32\cmd.exe /c echo flo

Communicates with host for which no DNS query was performed (1 event)

host

172.217.25.14

File has been identified by 13 AntiVirus engines on VirusTotal as malicious (13 events)

Elastic	malicious (high confidence)
McAfee	RDN/Gozi_Ifsb
ESET-NOD32	a variant of Generik.IJEUDFL
McAfee-GW-Edition	Artemis!Trojan
Sophos	Mal/Generic-S
APEX	Malicious
GData	Win32.Trojan-Spy.Ursnif.S9HA13
Webroot	W32.Trojan.Gen
Kingsoft	Win32.Troj.Generic.a.(kcloud)
Microsoft	Trojan:Win32/Tnega!ml
Cylance	Unsafe
Ikarus	Trojan.SuspectCRC
Rising	Malware.Undefined!8.C (CLOUD)

presentation.dll

Process Tree Toggle all

Network Toggle all

Suricata Toggle all

Suricata Alerts

Suricata TLS

Signatures Toggle All