Summary | ZeroBOX

Category	Machine	Started	Completed
FILE	s1_win7_x6401	May 4, 2021, 6:18 p.m.	May 4, 2021, 6:24 p.m.

Size	487.0KB
Type	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
MD5	`31980c9b17f61c5f808cb882e41083af`
SHA256	`505af1e265238f48bd732ff8f9c4c0cec133cbbde31fd618e45d6524b19aed73`
CRC32	`3BFCCEDA`
ssdeep	`6144:EcW6U27GIvgzJR+OikTEbuAEK9ZZMXvUTAAsQ:fP5uRik8uW9DMXMjsQ`
Yara	IsDLL - (no description) PE_Header_Zero - PE File Signature IsPE32 - (no description)

rundll32.exe "C:\Windows\System32\rundll32.exe" C:\Users\test22\AppData\Local\Temp\scr.dll,Main
1972
rundll32.exe "C:\Windows\System32\rundll32.exe" C:\Users\test22\AppData\Local\Temp\scr.dll,
3016

Name	Response	Post-Analysis Lookup
No hosts contacted.

IP Address	Status	Action
164.124.101.2	Active	Moloch
185.215.113.74	Active	Moloch

Suricata Alerts

Flow	SID	Signature	Category
TCP 185.215.113.74:80 -> 192.168.56.101:49198	2400023	ET DROP Spamhaus DROP Listed Traffic Inbound group 24	Misc Attack

Suricata TLS

No Suricata TLS

Checks if process is being debugged by a debugger (1 event)

Time & API	Arguments	Status	Return	Repeated
IsDebuggerPresent May 4, 2021, 6:18 p.m.			0	0

The executable contains unknown PE section names indicative of a packer (could be a false positive) (3 events)

section	.code
section	.yqvd
section

One or more potentially interesting buffers were extracted, these generally contain injected code, configuration data, etc.

HTTP traffic contains suspicious features which may be indicative of malware related traffic (1 event)

suspicious_features

POST method with no referer header, Connection to IP address

suspicious_request

POST http://185.215.113.74//4dcYcWsw3/index.php?scr=up

Performs some HTTP requests (1 event)

request

POST http://185.215.113.74//4dcYcWsw3/index.php?scr=up

Sends data using the HTTP POST Method (1 event)

request

POST http://185.215.113.74//4dcYcWsw3/index.php?scr=up

Allocates read-write-execute memory (usually to unpack itself) (15 events)

Time & API	Arguments	Status
NtProtectVirtualMemory May 4, 2021, 6:18 p.m.	process_identifier: 1972 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00697000 process_handle: 0xffffffff	1
NtProtectVirtualMemory May 4, 2021, 6:18 p.m.	process_identifier: 1972 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00697000 process_handle: 0xffffffff	1
NtProtectVirtualMemory May 4, 2021, 6:18 p.m.	process_identifier: 1972 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x73dd1000 process_handle: 0xffffffff	1
NtProtectVirtualMemory May 4, 2021, 6:18 p.m.	process_identifier: 1972 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x729f1000 process_handle: 0xffffffff	1
NtProtectVirtualMemory May 4, 2021, 6:18 p.m.	process_identifier: 1972 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x73d91000 process_handle: 0xffffffff	1
NtProtectVirtualMemory May 4, 2021, 6:18 p.m.	process_identifier: 1972 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x756a1000 process_handle: 0xffffffff	1
NtProtectVirtualMemory May 4, 2021, 6:18 p.m.	process_identifier: 1972 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x73d01000 process_handle: 0xffffffff	1
NtProtectVirtualMemory May 4, 2021, 6:18 p.m.	process_identifier: 1972 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x73cc1000 process_handle: 0xffffffff	1
NtAllocateVirtualMemory May 4, 2021, 6:18 p.m.	process_identifier: 1972 region_size: 491520 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x006a0000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtProtectVirtualMemory May 4, 2021, 6:18 p.m.	process_identifier: 1972 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 491520 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00620000 process_handle: 0xffffffff	1
NtProtectVirtualMemory May 4, 2021, 6:18 p.m.	process_identifier: 1972 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x73770000 process_handle: 0xffffffff	1
NtProtectVirtualMemory May 4, 2021, 6:18 p.m.	process_identifier: 1972 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x72981000 process_handle: 0xffffffff	1
NtProtectVirtualMemory May 4, 2021, 6:18 p.m.	process_identifier: 1972 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x72944000 process_handle: 0xffffffff	1
NtProtectVirtualMemory May 4, 2021, 6:18 p.m.	process_identifier: 1972 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x72982000 process_handle: 0xffffffff	1
NtProtectVirtualMemory May 4, 2021, 6:18 p.m.	process_identifier: 1972 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x73c91000 process_handle: 0xffffffff	1

Communicates with host for which no DNS query was performed (1 event)

host

185.215.113.74

File has been identified by 39 AntiVirus engines on VirusTotal as malicious (39 events)

Elastic	malicious (high confidence)
MicroWorld-eScan	Trojan.GenericKD.46205307
FireEye	Generic.mg.31980c9b17f61c5f
CAT-QuickHeal	Trojan.Multi
ALYac	Trojan.GenericKD.46205307
Cylance	Unsafe
Sangfor	Trojan.Win32.Save.a
CrowdStrike	win/malicious_confidence_100% (W)
Alibaba	Trojan:Win32/Kryptik.fad3bbe9
K7GW	Trojan ( 0057ba091 )
K7AntiVirus	Trojan ( 0057ba091 )
BitDefenderTheta	Gen:NN.ZedlaF.34686.EG4@aafyjdci
Cyren	W32/Trojan.EYIZ-8004
Symantec	ML.Attribute.HighConfidence
ESET-NOD32	a variant of Win32/Kryptik.HKQJ
APEX	Malicious
Avast	Win32:Trojan-gen
BitDefender	Trojan.GenericKD.46205307
Paloalto	generic.ml
AegisLab	Trojan.Multi.Generic.4!c
Rising	Trojan.GenKryptik!8.AA55 (CLOUD)
Ad-Aware	Trojan.GenericKD.46205307
Sophos	ML/PE-A + Mal/EncPk-APW
VIPRE	Trojan.Win32.Generic!BT
McAfee-GW-Edition	Artemis!Trojan
Emsisoft	Trojan.GenericKD.46205307 (B)
SentinelOne	Static AI - Suspicious PE
GData	Win32.Trojan.Agent.GDLYU0
Avira	TR/Crypt.Agent.fzffo
MAX	malware (ai score=100)
ZoneAlarm	UDS:DangerousObject.Multi.Generic
Microsoft	Trojan:Win32/Wacatac.B!ml
Cynet	Malicious (score: 100)
McAfee	Artemis!31980C9B17F6
TrendMicro-HouseCall	TROJ_GEN.R002C0RE221
Ikarus	Trojan.Win32.Krypt
MaxSecure	Virus.Patched.OF
Fortinet	W32/GenKryptik.FEQK!tr
AVG	Win32:Trojan-gen

scr.dll

Process Tree Toggle all

Network Toggle all

Suricata Toggle all

Suricata Alerts

Suricata TLS

Signatures Toggle All