Summary | ZeroBOX

Category	Machine	Started	Completed
FILE	s1_win7_x6401	May 25, 2021, 9:50 a.m.	May 25, 2021, 9:54 a.m.

Size	544.5KB
Type	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
MD5	`8b0aa7b2df531503ebb39aa142b004a8`
SHA256	`f09569b61b068a70e2570e2df7bd6ee6c288f8ccc4bd03ceabdf3fb6893261d1`
CRC32	`65A9CEFC`
ssdeep	`12288:XrH3MGVMH0t75f2dVlVk3BhvunYUB/hq44JS15yE4TeCVCP:bXMGVMH0tdaLkft2`
PDB Path	c:\occur_hat\832-follow\Village\brother\Science\Shine.pdb
Yara	IsDLL - (no description) PE_Header_Zero - PE File Signature OS_Processor_Check_Zero - OS Processor Check IsPE32 - (no description)

rundll32.exe "C:\Windows\System32\rundll32.exe" C:\Users\test22\AppData\Local\Temp\doc.dll,Areaexample
2548
rundll32.exe "C:\Windows\System32\rundll32.exe" C:\Users\test22\AppData\Local\Temp\doc.dll,DllRegisterServer
2388
rundll32.exe "C:\Windows\System32\rundll32.exe" C:\Users\test22\AppData\Local\Temp\doc.dll,DllUnregisterServer
2240
rundll32.exe "C:\Windows\System32\rundll32.exe" C:\Users\test22\AppData\Local\Temp\doc.dll,Drinkenerg1
1892
rundll32.exe "C:\Windows\System32\rundll32.exe" C:\Users\test22\AppData\Local\Temp\doc.dll,
2772

Name	Response	Post-Analysis Lookup
app.buboleinov.com

IP Address	Status	Action
164.124.101.2	Active	Moloch

Suricata Alerts

No Suricata Alerts

Suricata TLS

No Suricata TLS

Queries for the computername (17 events)

Time & API	Arguments	Status	Return
GetComputerNameW May 25, 2021, 9:51 a.m.	computer_name:		0
GetComputerNameW May 25, 2021, 9:51 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameW May 25, 2021, 9:51 a.m.	computer_name:		0
GetComputerNameW May 25, 2021, 9:51 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameW May 25, 2021, 9:52 a.m.	computer_name:		0
GetComputerNameW May 25, 2021, 9:52 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameW May 25, 2021, 9:52 a.m.	computer_name:		0
GetComputerNameW May 25, 2021, 9:52 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameW May 25, 2021, 9:52 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameW May 25, 2021, 9:51 a.m.	computer_name:		0
GetComputerNameW May 25, 2021, 9:51 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameW May 25, 2021, 9:51 a.m.	computer_name:		0
GetComputerNameW May 25, 2021, 9:51 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameW May 25, 2021, 9:51 a.m.	computer_name:		0
GetComputerNameW May 25, 2021, 9:51 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameW May 25, 2021, 9:51 a.m.	computer_name:		0
GetComputerNameW May 25, 2021, 9:51 a.m.	computer_name: TEST22-PC	1	1

Checks if process is being debugged by a debugger (1 event)

Time & API	Arguments	Status	Return	Repeated
IsDebuggerPresent May 25, 2021, 9:51 a.m.			0	0

Collects information to fingerprint the system (MachineGuid, DigitalProductId, SystemBiosDate) (1 event)

registry

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\InstallDate

This executable has a PDB path (1 event)

pdb_path

c:\occur_hat\832-follow\Village\brother\Science\Shine.pdb

Checks amount of memory in system, this can be used to detect virtual machines that have a low amount of memory available (1 event)

Time & API	Arguments	Status	Return	Repeated
GlobalMemoryStatusEx May 25, 2021, 9:51 a.m.		1	1	0

Allocates read-write-execute memory (usually to unpack itself) (34 events)

Time & API	Arguments	Status
NtProtectVirtualMemory May 25, 2021, 9:50 a.m.	process_identifier: 2548 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x6eafe000 process_handle: 0xffffffff	1
NtProtectVirtualMemory May 25, 2021, 9:51 a.m.	process_identifier: 2548 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 20480 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x6eb48000 process_handle: 0xffffffff	1
NtAllocateVirtualMemory May 25, 2021, 9:51 a.m.	process_identifier: 2548 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x007f0000 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0xffffffff	1
NtAllocateVirtualMemory May 25, 2021, 9:51 a.m.	process_identifier: 2548 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00800000 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0xffffffff	1
NtAllocateVirtualMemory May 25, 2021, 9:51 a.m.	process_identifier: 2548 region_size: 151552 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00810000 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0xffffffff	1
NtProtectVirtualMemory May 25, 2021, 9:51 a.m.	process_identifier: 2548 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x736f1000 process_handle: 0xffffffff	1
NtProtectVirtualMemory May 25, 2021, 9:51 a.m.	process_identifier: 2548 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x72a51000 process_handle: 0xffffffff	1
NtProtectVirtualMemory May 25, 2021, 9:50 a.m.	process_identifier: 2388 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x6eafe000 process_handle: 0xffffffff	1
NtProtectVirtualMemory May 25, 2021, 9:51 a.m.	process_identifier: 2388 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 20480 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x6eb48000 process_handle: 0xffffffff	1
NtAllocateVirtualMemory May 25, 2021, 9:51 a.m.	process_identifier: 2388 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00300000 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0xffffffff	1
NtAllocateVirtualMemory May 25, 2021, 9:51 a.m.	process_identifier: 2388 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00310000 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0xffffffff	1
NtAllocateVirtualMemory May 25, 2021, 9:51 a.m.	process_identifier: 2388 region_size: 151552 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00320000 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0xffffffff	1
NtProtectVirtualMemory May 25, 2021, 9:51 a.m.	process_identifier: 2388 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x73d40000 process_handle: 0xffffffff	1
NtProtectVirtualMemory May 25, 2021, 9:51 a.m.	process_identifier: 2388 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x73cc1000 process_handle: 0xffffffff	1
NtProtectVirtualMemory May 25, 2021, 9:51 a.m.	process_identifier: 2388 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x73751000 process_handle: 0xffffffff	1
NtProtectVirtualMemory May 25, 2021, 9:51 a.m.	process_identifier: 2388 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x72b94000 process_handle: 0xffffffff	1
NtProtectVirtualMemory May 25, 2021, 9:51 a.m.	process_identifier: 2388 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x73cc2000 process_handle: 0xffffffff	1
NtProtectVirtualMemory May 25, 2021, 9:51 a.m.	process_identifier: 2388 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x73ca1000 process_handle: 0xffffffff	1
NtProtectVirtualMemory May 25, 2021, 9:51 a.m.	process_identifier: 2388 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x736f1000 process_handle: 0xffffffff	1
NtProtectVirtualMemory May 25, 2021, 9:51 a.m.	process_identifier: 2388 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x72a51000 process_handle: 0xffffffff	1
NtProtectVirtualMemory May 25, 2021, 9:50 a.m.	process_identifier: 2240 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x6eafe000 process_handle: 0xffffffff	1
NtProtectVirtualMemory May 25, 2021, 9:51 a.m.	process_identifier: 2240 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 20480 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x6eb48000 process_handle: 0xffffffff	1
NtAllocateVirtualMemory May 25, 2021, 9:51 a.m.	process_identifier: 2240 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x007e0000 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0xffffffff	1
NtAllocateVirtualMemory May 25, 2021, 9:51 a.m.	process_identifier: 2240 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x007f0000 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0xffffffff	1
NtAllocateVirtualMemory May 25, 2021, 9:51 a.m.	process_identifier: 2240 region_size: 151552 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00800000 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0xffffffff	1
NtProtectVirtualMemory May 25, 2021, 9:51 a.m.	process_identifier: 2240 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x736f1000 process_handle: 0xffffffff	1
NtProtectVirtualMemory May 25, 2021, 9:51 a.m.	process_identifier: 2240 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x72a51000 process_handle: 0xffffffff	1
NtProtectVirtualMemory May 25, 2021, 9:50 a.m.	process_identifier: 1892 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x6eafe000 process_handle: 0xffffffff	1
NtProtectVirtualMemory May 25, 2021, 9:51 a.m.	process_identifier: 1892 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 20480 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x6eb48000 process_handle: 0xffffffff	1
NtAllocateVirtualMemory May 25, 2021, 9:51 a.m.	process_identifier: 1892 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x002f0000 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0xffffffff	1
NtAllocateVirtualMemory May 25, 2021, 9:51 a.m.	process_identifier: 1892 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00300000 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0xffffffff	1
NtAllocateVirtualMemory May 25, 2021, 9:51 a.m.	process_identifier: 1892 region_size: 151552 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00310000 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0xffffffff	1
NtProtectVirtualMemory May 25, 2021, 9:51 a.m.	process_identifier: 1892 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x736f1000 process_handle: 0xffffffff	1
NtProtectVirtualMemory May 25, 2021, 9:51 a.m.	process_identifier: 1892 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x72a51000 process_handle: 0xffffffff	1

Changes read-write memory protection to read-execute (probably to avoid detection when setting all RWX flags at the same time) (1 event)

Time & API	Arguments	Status	Return	Repeated
NtProtectVirtualMemory May 25, 2021, 9:51 a.m.	process_identifier: 1892 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 32768 protection: 32 (PAGE_EXECUTE_READ) base_address: 0x00651000 process_handle: 0xffffffff	1	0	0

File has been identified by 33 AntiVirus engines on VirusTotal as malicious (33 events)

MicroWorld-eScan	Trojan.GenericKD.36950895
CAT-QuickHeal	Trojan.Multi
McAfee	Artemis!8B0AA7B2DF53
Sangfor	Riskware.Win32.Agent.ky
K7AntiVirus	Trojan ( 0057cee21 )
Alibaba	Trojan:Win32/SuspectCRC.1367eebe
K7GW	Trojan ( 0057cee21 )
Arcabit	Trojan.Generic.D233D36F
Symantec	ML.Attribute.HighConfidence
ESET-NOD32	a variant of Generik.MYUZYCZ
TrendMicro-HouseCall	TROJ_GEN.R002C0REO21
Kaspersky	UDS:DangerousObject.Multi.Generic
BitDefender	Trojan.GenericKD.36950895
Avast	Win32:Trojan-gen
Ad-Aware	Trojan.GenericKD.36950895
Emsisoft	Trojan.GenericKD.36950895 (B)
Comodo	Malware@#1zuq7lx0aenhb
DrWeb	Trojan.Gozi.803
TrendMicro	TROJ_GEN.R002C0REO21
McAfee-GW-Edition	Artemis!Trojan
FireEye	Generic.mg.8b0aa7b2df531503
Sophos	Mal/Generic-S + Troj/Dridex-AGZ
MAX	malware (ai score=88)
Kingsoft	Win32.Troj.Generic_a.a.(kcloud)
Microsoft	Trojan:Win32/Wacatac.B!ml
AegisLab	Trojan.Multi.Generic.4!c
ZoneAlarm	UDS:DangerousObject.Multi.Generic
GData	Trojan.GenericKD.36950895
Cynet	Malicious (score: 100)
Ikarus	Trojan.SuspectCRC
Rising	Malware.Undefined!8.C (CLOUD)
Fortinet	W32/GenKryptik.FFPZ!tr
AVG	Win32:Trojan-gen

doc.dll

Process Tree Toggle all

Network Toggle all

Suricata Toggle all

Suricata Alerts

Suricata TLS

Signatures Toggle All