Summary | ZeroBOX

Category	Machine	Started	Completed
FILE	s1_win7_x6402	June 17, 2021, 5:48 p.m.	June 17, 2021, 5:55 p.m.

Size	277.5KB
Type	PE32 executable (DLL) (console) Intel 80386 (stripped to external PDB), for MS Windows
MD5	`928163504cf073fe38f6e9cc0f91251c`
SHA256	`f00c2f5474bdcd89606221ce0d29f8e8e6b0cca150433286bcd3ab8b8e7e832e`
CRC32	`00691E06`
ssdeep	`3072:TSEQw/mIOfSAAmLGGxR1pB0lxZ0J9FIRKmj8q2Jclf3tcw:TSEQ8IXqOR3B0lxqJ9oK08q2+pCw`
Yara	PE_Header_Zero - PE File Signature IsDLL - (no description) IsPE32 - (no description)

rundll32.exe "C:\Windows\System32\rundll32.exe" C:\Users\test22\AppData\Local\Temp\TRVSz8V0.dll,DllGetClassObject
4208
rundll32.exe "C:\Windows\System32\rundll32.exe" C:\Users\test22\AppData\Local\Temp\TRVSz8V0.dll,DllMain
7748
rundll32.exe "C:\Windows\System32\rundll32.exe" C:\Users\test22\AppData\Local\Temp\TRVSz8V0.dll,DllRegisterServer
1472
rundll32.exe "C:\Windows\System32\rundll32.exe" C:\Users\test22\AppData\Local\Temp\TRVSz8V0.dll,DllUnregisterServer
4016
rundll32.exe "C:\Windows\System32\rundll32.exe" C:\Users\test22\AppData\Local\Temp\TRVSz8V0.dll,StartW
5888
rundll32.exe "C:\Windows\System32\rundll32.exe" C:\Users\test22\AppData\Local\Temp\TRVSz8V0.dll,
7772

Name	Response	Post-Analysis Lookup
No hosts contacted.

IP Address	Status	Action
172.217.25.14	Active	Moloch
80.82.67.127	Active	Moloch

Suricata Alerts

No Suricata Alerts

Suricata TLS

No Suricata TLS

Queries for the computername (1 event)

Time & API	Arguments	Status	Return	Repeated
GetComputerNameA June 17, 2021, 5:48 p.m.	computer_name: TEST22-PC	1	1	0

Checks if process is being debugged by a debugger (5 events)

Time & API	Arguments	Status	Return	Repeated
IsDebuggerPresent June 17, 2021, 5:48 p.m.			0	0
IsDebuggerPresent June 17, 2021, 5:48 p.m.			0	0
IsDebuggerPresent June 17, 2021, 5:48 p.m.			0	0
IsDebuggerPresent June 17, 2021, 5:48 p.m.			0	0
IsDebuggerPresent June 17, 2021, 5:48 p.m.			0	0

HTTP traffic contains suspicious features which may be indicative of malware related traffic (1 event)

suspicious_features

Connection to IP address

suspicious_request

GET http://80.82.67.127/IE9CompatViewList.xml

Performs some HTTP requests (1 event)

request

GET http://80.82.67.127/IE9CompatViewList.xml

Allocates read-write-execute memory (usually to unpack itself) (42 events)

Time & API	Arguments	Status
NtProtectVirtualMemory June 17, 2021, 5:48 p.m.	process_identifier: 4208 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x73e80000 process_handle: 0xffffffff	1
NtProtectVirtualMemory June 17, 2021, 5:48 p.m.	process_identifier: 4208 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x73771000 process_handle: 0xffffffff	1
NtProtectVirtualMemory June 17, 2021, 5:48 p.m.	process_identifier: 4208 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x73861000 process_handle: 0xffffffff	1
NtProtectVirtualMemory June 17, 2021, 5:48 p.m.	process_identifier: 4208 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x72da4000 process_handle: 0xffffffff	1
NtProtectVirtualMemory June 17, 2021, 5:48 p.m.	process_identifier: 4208 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x73772000 process_handle: 0xffffffff	1
NtProtectVirtualMemory June 17, 2021, 5:48 p.m.	process_identifier: 4208 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x73e01000 process_handle: 0xffffffff	1
NtProtectVirtualMemory June 17, 2021, 5:48 p.m.	process_identifier: 7748 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x73e80000 process_handle: 0xffffffff	1
NtProtectVirtualMemory June 17, 2021, 5:48 p.m.	process_identifier: 7748 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x73771000 process_handle: 0xffffffff	1
NtProtectVirtualMemory June 17, 2021, 5:48 p.m.	process_identifier: 7748 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x72231000 process_handle: 0xffffffff	1
NtProtectVirtualMemory June 17, 2021, 5:48 p.m.	process_identifier: 7748 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x72da4000 process_handle: 0xffffffff	1
NtProtectVirtualMemory June 17, 2021, 5:48 p.m.	process_identifier: 7748 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x73772000 process_handle: 0xffffffff	1
NtProtectVirtualMemory June 17, 2021, 5:48 p.m.	process_identifier: 7748 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x73e01000 process_handle: 0xffffffff	1
NtProtectVirtualMemory June 17, 2021, 5:48 p.m.	process_identifier: 1472 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x73e80000 process_handle: 0xffffffff	1
NtProtectVirtualMemory June 17, 2021, 5:48 p.m.	process_identifier: 1472 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x73771000 process_handle: 0xffffffff	1
NtProtectVirtualMemory June 17, 2021, 5:48 p.m.	process_identifier: 1472 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x73861000 process_handle: 0xffffffff	1
NtProtectVirtualMemory June 17, 2021, 5:48 p.m.	process_identifier: 1472 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x72da4000 process_handle: 0xffffffff	1
NtProtectVirtualMemory June 17, 2021, 5:48 p.m.	process_identifier: 1472 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x73772000 process_handle: 0xffffffff	1
NtProtectVirtualMemory June 17, 2021, 5:48 p.m.	process_identifier: 1472 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x73e01000 process_handle: 0xffffffff	1
NtProtectVirtualMemory June 17, 2021, 5:48 p.m.	process_identifier: 4016 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x73e80000 process_handle: 0xffffffff	1
NtProtectVirtualMemory June 17, 2021, 5:48 p.m.	process_identifier: 4016 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x73771000 process_handle: 0xffffffff	1
NtProtectVirtualMemory June 17, 2021, 5:48 p.m.	process_identifier: 4016 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x72231000 process_handle: 0xffffffff	1
NtProtectVirtualMemory June 17, 2021, 5:48 p.m.	process_identifier: 4016 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x72da4000 process_handle: 0xffffffff	1
NtProtectVirtualMemory June 17, 2021, 5:48 p.m.	process_identifier: 4016 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x73772000 process_handle: 0xffffffff	1
NtProtectVirtualMemory June 17, 2021, 5:48 p.m.	process_identifier: 4016 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x73e01000 process_handle: 0xffffffff	1
NtProtectVirtualMemory June 17, 2021, 5:48 p.m.	process_identifier: 5888 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x73e80000 process_handle: 0xffffffff	1
NtProtectVirtualMemory June 17, 2021, 5:48 p.m.	process_identifier: 5888 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x73771000 process_handle: 0xffffffff	1
NtProtectVirtualMemory June 17, 2021, 5:48 p.m.	process_identifier: 5888 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x73861000 process_handle: 0xffffffff	1
NtProtectVirtualMemory June 17, 2021, 5:48 p.m.	process_identifier: 5888 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x72da4000 process_handle: 0xffffffff	1
NtProtectVirtualMemory June 17, 2021, 5:48 p.m.	process_identifier: 5888 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x73772000 process_handle: 0xffffffff	1
NtProtectVirtualMemory June 17, 2021, 5:48 p.m.	process_identifier: 5888 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x73e01000 process_handle: 0xffffffff	1
NtAllocateVirtualMemory June 17, 2021, 5:48 p.m.	process_identifier: 5888 region_size: 249856 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00490000 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0xffffffff	1
NtProtectVirtualMemory June 17, 2021, 5:48 p.m.	process_identifier: 5888 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x75111000 process_handle: 0xffffffff	1
NtProtectVirtualMemory June 17, 2021, 5:48 p.m.	process_identifier: 5888 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x75241000 process_handle: 0xffffffff	1
NtProtectVirtualMemory June 17, 2021, 5:48 p.m.	process_identifier: 5888 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x74f41000 process_handle: 0xffffffff	1
NtProtectVirtualMemory June 17, 2021, 5:48 p.m.	process_identifier: 5888 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x76891000 process_handle: 0xffffffff	1
NtProtectVirtualMemory June 17, 2021, 5:48 p.m.	process_identifier: 5888 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x73db1000 process_handle: 0xffffffff	1
NtProtectVirtualMemory June 17, 2021, 5:48 p.m.	process_identifier: 5888 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x71f61000 process_handle: 0xffffffff	1
NtProtectVirtualMemory June 17, 2021, 5:48 p.m.	process_identifier: 5888 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x66fe1000 process_handle: 0xffffffff	1
NtProtectVirtualMemory June 17, 2021, 5:48 p.m.	process_identifier: 5888 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x66fc1000 process_handle: 0xffffffff	1
NtProtectVirtualMemory June 17, 2021, 5:48 p.m.	process_identifier: 5888 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x73321000 process_handle: 0xffffffff	1
NtProtectVirtualMemory June 17, 2021, 5:48 p.m.	process_identifier: 5888 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x73e21000 process_handle: 0xffffffff	1
NtProtectVirtualMemory June 17, 2021, 5:48 p.m.	process_identifier: 5888 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x66fb1000 process_handle: 0xffffffff	1

A process attempted to delay the analysis task. (1 event)

description

rundll32.exe tried to sleep 120 seconds, actually delayed analysis time by 120 seconds

Changes read-write memory protection to read-execute (probably to avoid detection when setting all RWX flags at the same time) (1 event)

Time & API	Arguments	Status	Return	Repeated
NtProtectVirtualMemory June 17, 2021, 5:48 p.m.	process_identifier: 5888 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 length: 208896 protection: 32 (PAGE_EXECUTE_READ) base_address: 0x00350000 process_handle: 0xffffffff	1	0	0

Communicates with host for which no DNS query was performed (2 events)

host	172.217.25.14
host	80.82.67.127

File has been identified by 30 AntiVirus engines on VirusTotal as malicious (30 events)

Elastic	malicious (high confidence)
MicroWorld-eScan	Gen:Trojan.Heur.rK4@InjxnMe
FireEye	Generic.mg.928163504cf073fe
ALYac	Gen:Trojan.Heur.rK4@InjxnMe
Sangfor	Trojan.Win32.Save.a
K7AntiVirus	Riskware ( 0049f6ae1 )
K7GW	Riskware ( 0049f6ae1 )
CrowdStrike	win/malicious_confidence_80% (D)
Symantec	Backdoor.Cobalt!gm1
ESET-NOD32	a variant of Win32/RiskWare.CobaltStrike.Artifact.D.gen
APEX	Malicious
ClamAV	Win.Countermeasure.LoaderWinGeneric-9804845-2
Kaspersky	HEUR:Trojan.Win64.Cobalt.gen
BitDefender	Gen:Trojan.Heur.rK4@InjxnMe
Ad-Aware	Gen:Trojan.Heur.rK4@InjxnMe
Sophos	ATK/Cobalt-W
TrendMicro	Trojan.Win32.LOADER.SM
McAfee-GW-Edition	Injector-FEY.c!928163504CF0
Emsisoft	Gen:Trojan.Heur.rK4@InjxnMe (B)
Avira	TR/Crypt.XDR.Gen
GData	Gen:Trojan.Heur.rK4@InjxnMe
Cynet	Malicious (score: 100)
McAfee	Injector-FEY.c!928163504CF0
MAX	malware (ai score=87)
VBA32	BScope.Trojan.Swrort
Malwarebytes	Trojan.Loader.Feye.Generic
TrendMicro-HouseCall	Trojan.Win32.LOADER.SM
SentinelOne	Static AI - Suspicious PE
BitDefenderTheta	AI:Packer.395B7C391B
Panda	Trj/GdSda.A

TRVSz8V0

Process Tree Toggle all

Network Toggle all

Suricata Toggle all

Suricata Alerts

Suricata TLS

Signatures Toggle All