popup
Summary | ZeroBOX
  1. Home
  2. Result
  3. Report
  4. Detail Analysis

deli_driver.exe

Gen1 Emotet Generic Malware Admin Tool (Sysinternals etc ...) UPX Anti_VM PE File OS Processor Check PE32
  1. Resubmit sample
Category Machine Started Completed
FILE s1_win7_x6402 June 24, 2021, 11:49 p.m. June 24, 2021, 11:52 p.m.
Size 3.7MB
Type PE32 executable (GUI) Intel 80386, for MS Windows
MD5 6348584e7297e257afe64e59efbfe223
SHA256 6f03fba6702cb99f1b9b45f60dbfd9d52e3d5ce019bcf4e68d91dbf54592c236
CRC32 90D903D4
ssdeep 98304:MG5CHAgcbmdkYORTXQBwL6oOhUzdPjrq23:MGAqgvOREXSdPjrj
Yara
  • PE_Header_Zero - PE File Signature
  • IsPE32 - (no description)

Name Response Post-Analysis Lookup
No hosts contacted.
IP Address Status Action
172.217.25.14 Active Moloch
34.104.35.123 Active Moloch

Suricata Alerts

No Suricata Alerts

Suricata TLS

No Suricata TLS

file C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
Time & API Arguments Status Return Repeated

GlobalMemoryStatusEx

 1 1 0
section CODE
section DATA
section BSS
Time & API Arguments Status Return Repeated

NtProtectVirtualMemory

 process_identifier: 7688
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x73871000
process_handle: 0xffffffff
1 0 0

NtProtectVirtualMemory

 process_identifier: 7688
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x73771000
process_handle: 0xffffffff
1 0 0

NtProtectVirtualMemory

 process_identifier: 7688
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x72da4000
process_handle: 0xffffffff
1 0 0

NtProtectVirtualMemory

 process_identifier: 7688
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x73772000
process_handle: 0xffffffff
1 0 0

NtProtectVirtualMemory

 process_identifier: 7688
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x73e01000
process_handle: 0xffffffff
1 0 0

NtProtectVirtualMemory

 process_identifier: 7688
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x74f41000
process_handle: 0xffffffff
1 0 0

NtProtectVirtualMemory

 process_identifier: 7688
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x75111000
process_handle: 0xffffffff
1 0 0

NtProtectVirtualMemory

 process_identifier: 7688
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x73dd1000
process_handle: 0xffffffff
1 0 0

NtProtectVirtualMemory

 process_identifier: 7688
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x74e51000
process_handle: 0xffffffff
1 0 0

NtProtectVirtualMemory

 process_identifier: 7688
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x768d1000
process_handle: 0xffffffff
1 0 0

NtProtectVirtualMemory

 process_identifier: 7688
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x74e21000
process_handle: 0xffffffff
1 0 0

NtProtectVirtualMemory

 process_identifier: 7688
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x750f1000
process_handle: 0xffffffff
1 0 0

NtProtectVirtualMemory

 process_identifier: 7688
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x72201000
process_handle: 0xffffffff
1 0 0

NtProtectVirtualMemory

 process_identifier: 7688
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x72711000
process_handle: 0xffffffff
1 0 0

NtProtectVirtualMemory

 process_identifier: 7688
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x72bb1000
process_handle: 0xffffffff
1 0 0

NtProtectVirtualMemory

 process_identifier: 7688
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x75401000
process_handle: 0xffffffff
1 0 0

NtProtectVirtualMemory

 process_identifier: 7688
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x765b1000
process_handle: 0xffffffff
1 0 0

NtProtectVirtualMemory

 process_identifier: 7688
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x743e1000
process_handle: 0xffffffff
1 0 0

NtProtectVirtualMemory

 process_identifier: 7688
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x72961000
process_handle: 0xffffffff
1 0 0

NtProtectVirtualMemory

 process_identifier: 7688
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x72821000
process_handle: 0xffffffff
1 0 0

NtProtectVirtualMemory

 process_identifier: 7688
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x71fc1000
process_handle: 0xffffffff
1 0 0
file C:\Users\test22\AppData\Local\Google\Chrome\User Data\recovery\101.3.34.11\ChromeRecovery.exe
file C:\Program Files (x86)\Mozilla Thunderbird\pingsender.exe
file C:\Program Files (x86)\Google\Update\1.3.36.32\GoogleUpdateBroker.exe
file C:\Program Files (x86)\Google\Update\Download\{430FD4D0-B729-4F61-AA34-91526481799D}\1.3.36.32\GoogleUpdateSetup.exe
file C:\Program Files (x86)\Hnc\HncUtils\HncUpdate.exe
file C:\Program Files (x86)\Mozilla Thunderbird\plugin-container.exe
file C:\Program Files (x86)\Microsoft Office\Office12\REGFORM.EXE
file C:\Program Files (x86)\Microsoft Office\Office12\DSSM.EXE
file C:\Python27\Lib\site-packages\setuptools\cli-32.exe
file C:\Program Files (x86)\Microsoft Office\Office12\ACCICONS.EXE
file C:\Program Files (x86)\Common Files\microsoft shared\OFFICE12\ODSERV.EXE
file C:\Python27\Scripts\easy_install.exe
file C:\Program Files (x86)\Microsoft Office\Office12\WINWORD.EXE
file C:\MSOCache\All Users\{90120000-0030-0000-0000-0000000FF1CE}-C\ose.exe
file C:\Python27\Lib\site-packages\pip\_vendor\distlib\w32.exe
file C:\Program Files (x86)\7-Zip\7z.exe
file C:\Program Files (x86)\Hnc\Common80\HimTrayIcon.exe
file C:\Program Files (x86)\Hnc\Hwp80\HwpFinder.exe
file C:\Program Files (x86)\Microsoft Office\Office12\SELFCERT.EXE
file C:\Program Files (x86)\Microsoft Office\Office12\PPTVIEW.EXE
file C:\Program Files (x86)\Microsoft Office\Office12\MSPUB.EXE
file C:\Program Files (x86)\EditPlus\editplus.exe
file C:\Python27\Lib\site-packages\pip\_vendor\distlib\t64.exe
file C:\Program Files (x86)\Hnc\Hwp80\HwpPrnMng.exe
file C:\Python27\Lib\site-packages\pip\_vendor\distlib\t32.exe
file C:\Program Files (x86)\Google\Chrome\Application\chrome_proxy.exe
file C:\Program Files (x86)\Mozilla Thunderbird\maintenanceservice.exe
file C:\Program Files (x86)\Mozilla Thunderbird\minidump-analyzer.exe
file C:\Program Files (x86)\Common Files\microsoft shared\EQUATION\EQNEDT32.EXE
file C:\Program Files (x86)\Mozilla Thunderbird\crashreporter.exe
file C:\MSOCache\All Users\{90120000-006E-0412-0000-0000000FF1CE}-C\DW20.EXE
file C:\Program Files (x86)\Microsoft Office\Office12\INFOPATH.EXE
file C:\Program Files (x86)\Mozilla Maintenance Service\Uninstall.exe
file C:\Program Files (x86)\Hnc\Common80\HncReporter.exe
file C:\Program Files (x86)\7-Zip\7zFM.exe
file C:\Program Files (x86)\Common Files\microsoft shared\IME14\SHARED\IMEKLMG.EXE
file C:\Program Files (x86)\Microsoft Office\Office12\1042\ONELEV.EXE
file C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
file C:\Program Files (x86)\Google\Chrome\Application\86.0.4240.111\notification_helper.exe
file C:\Program Files (x86)\Hnc\Hwp80\HncPUAConverter.exe
file C:\Program Files (x86)\Microsoft Office\Office12\MSTORE.EXE
file C:\Program Files (x86)\Hnc\HncDic80\HncDic.exe
file C:\Program Files (x86)\Microsoft Office\Office12\MSTORDB.EXE
file C:\Program Files (x86)\Common Files\microsoft shared\OFFICE12\ACECNFLT.EXE
file C:\Users\test22\AppData\Local\Google\Chrome\User Data\recovery\101.3.34.11\ChromeRecovery.exe
file C:\Program Files (x86)\Hnc\Hwp80\Hwp.exe
file C:\Program Files (x86)\Microsoft Office\Office12\MSQRY32.EXE
file C:\Program Files (x86)\Google\Update\1.3.36.32\GoogleCrashHandler64.exe
file C:\util\dotnet4.5.exe
file C:\Program Files (x86)\Google\Update\GoogleUpdate.exe
file C:\Program Files (x86)\Common Files\microsoft shared\Source Engine\OSE.EXE
file C:\Users\test22\AppData\Local\Temp\3582-490\deli_driver.exe
file C:\Users\test22\AppData\Local\Temp\3582-490\deli_driver.exe
file C:\Users\test22\AppData\Local\Google\Chrome\User Data\recovery\101.3.34.11\ChromeRecovery.exe
Time & API Arguments Status Return Repeated

NtProtectVirtualMemory

 process_identifier: 7688
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
length: 4096
protection: 32 (PAGE_EXECUTE_READ)
base_address: 0x7ef90000
process_handle: 0xffffffff
1 0 0
host 172.217.25.14
host 34.104.35.123
reg_key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\exefile\shell\open\command\(Default) reg_value C:\Windows\svchost.com "%1" %*