popup
Summary | ZeroBOX
  1. Home
  2. Result
  3. Report
  4. Detail Analysis

123001.exe

Malicious Library OS Processor Check PE32 PE File DLL
  1. Resubmit sample
Category Machine Started Completed
FILE s1_win7_x6402 June 24, 2021, 7:30 p.m. June 24, 2021, 7:53 p.m.
Size 62.0KB
Type PE32 executable (GUI) Intel 80386, for MS Windows
MD5 2d50dbb80e4e0974ac31b1b7b0586b43
SHA256 c973c31f8af3d15abb5963e2764f534e5263828320e9c15e57c953392c32ce65
CRC32 A2C0DCCA
ssdeep 768:jbz3IhpglwpDEq2m0j6Tf8V4Ie7ZZa3R1fb961vNPrl7EJnCJ0uSN:n4+wpDElm2IAUZZo1fbs1RVEZCJ01
Yara
  • PE_Header_Zero - PE File Signature
  • OS_Processor_Check_Zero - OS Processor Check
  • IsPE32 - (no description)
  • Malicious_Library_Zero - Malicious_Library

Name Response Post-Analysis Lookup
20xixi.com
A 42.193.37.143
42.193.37.143
IP Address Status Action
164.124.101.2 Active Moloch
172.217.25.14 Active Moloch
42.193.37.143 Active Moloch

Suricata Alerts

No Suricata Alerts

Suricata TLS

No Suricata TLS

resource name None
name RT_DIALOG language LANG_CHINESE filetype data sublanguage SUBLANG_CHINESE_SIMPLIFIED offset 0x00011448 size 0x00000196
name RT_DIALOG language LANG_CHINESE filetype data sublanguage SUBLANG_CHINESE_SIMPLIFIED offset 0x00011448 size 0x00000196
name RT_DIALOG language LANG_CHINESE filetype data sublanguage SUBLANG_CHINESE_SIMPLIFIED offset 0x00011448 size 0x00000196
name RT_VERSION language LANG_CHINESE filetype data sublanguage SUBLANG_CHINESE_SIMPLIFIED offset 0x00011828 size 0x000002d0
name RT_MANIFEST language LANG_CHINESE filetype XML 1.0 document text sublanguage SUBLANG_CHINESE_SIMPLIFIED offset 0x00011190 size 0x0000028b
name None language LANG_CHINESE filetype data sublanguage SUBLANG_CHINESE_SIMPLIFIED offset 0x00011770 size 0x000000b6
Time & API Arguments Status Return Repeated

CreateServiceA

 service_start_name:
start_type: 2
password:
display_name: System Remote Data Simulation Layer
filepath: C:\Users\test22\AppData\Local\Temp\%SystemRoot%\System32\svchost.exe -k "Rundll32"
service_name: Rundll32
filepath_r: %SystemRoot%\System32\svchost.exe -k "Rundll32"
desired_access: 983551
service_handle: 0x005a43d8
error_control: 0
service_type: 272
service_manager_handle: 0x005a4478
1 5915608 0
host 172.217.25.14
service_name Rundll32 service_path C:\Users\test22\AppData\Local\Temp\%SystemRoot%\System32\svchost.exe -k "Rundll32"
reg_key HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\Rundll32\Parameters\ServiceDll reg_value C:\Windows\system32\25276046.txt