popup
Summary | ZeroBOX
  1. Home
  2. Result
  3. Report
  4. Detail Analysis

Apollo.exe

Emotet Gen1 Generic Malware PE64 PE File OS Processor Check PE32 DLL
  1. Resubmit sample
Category Machine Started Completed
FILE s1_win7_x6401 June 25, 2021, 9:59 a.m. June 25, 2021, 10:32 a.m.
Size 2.5MB
Type PE32 executable (GUI) Intel 80386, for MS Windows
MD5 b7ab9be4936d5128e13a976d4b629dd8
SHA256 9105599faee6b8cbbfb8f7c8a61ef6fc3a59dcd7230877149a89ce2dc7696e3d
CRC32 7714284C
ssdeep 49152:FgZDw/uEIGjeo2Rf4+XaFpPvRtOTHUybAhHZ6O:iZDmaGmha/eT0ybAXV
Yara
  • PE_Header_Zero - PE File Signature
  • IsPE32 - (no description)
  • Win32_Trojan_Emotet_2_Zero - Win32 Trojan Emotet

Name Response Post-Analysis Lookup
No hosts contacted.
IP Address Status Action
103.70.5.247 Active Moloch
164.124.101.2 Active Moloch

Suricata Alerts

No Suricata Alerts

Suricata TLS

No Suricata TLS

Time & API Arguments Status Return Repeated

IsDebuggerPresent

 0 0
Time & API Arguments Status Return Repeated

GlobalMemoryStatusEx

 1 1 0
section .itext
Time & API Arguments Status Return Repeated

NtProtectVirtualMemory

 process_identifier: 2220
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x00400000
process_handle: 0xffffffff
1 0 0

NtProtectVirtualMemory

 process_identifier: 2220
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 61440
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x00401000
process_handle: 0xffffffff
1 0 0

NtProtectVirtualMemory

 process_identifier: 2220
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 49152
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x00419000
process_handle: 0xffffffff
1 0 0

NtProtectVirtualMemory

 process_identifier: 2220
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x73702000
process_handle: 0xffffffff
1 0 0

NtProtectVirtualMemory

 process_identifier: 732
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x73702000
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 732
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x00590000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0
Time & API Arguments Status Return Repeated

GetDiskFreeSpaceExW

 total_number_of_free_bytes: 13725069312
free_bytes_available: 13725069312
root_path: C:\
total_number_of_bytes: 34252779520
1 1 0
file C:\Users\test22\AppData\Local\Temp\is-M2S1D.tmp\_isetup\_shfoldr.dll
file C:\Users\test22\AppData\Local\Temp\is-M2S1D.tmp\_isetup\_shfoldr.dll
file C:\Users\test22\AppData\Local\Temp\is-NFBKL.tmp\Apollo.tmp
Time & API Arguments Status Return Repeated

RegOpenKeyExW

 regkey_r: Software\Microsoft\Windows\CurrentVersion\Uninstall\Apollo_is1
base_handle: 0x80000001
key_handle: 0x00000000
options: 0
access: 0x00000001
regkey: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Uninstall\Apollo_is1
2 0

RegOpenKeyExW

 regkey_r: Software\Microsoft\Windows\CurrentVersion\Uninstall\Apollo_is1
base_handle: 0x80000002
key_handle: 0x00000000
options: 0
access: 0x00000001
regkey: HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Uninstall\Apollo_is1
2 0

RegOpenKeyExW

 regkey_r: Software\Microsoft\Windows\CurrentVersion\Uninstall\Apollo_is1
base_handle: 0x80000001
key_handle: 0x00000000
options: 0
access: 0x00000001
regkey: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Uninstall\Apollo_is1
2 0

RegOpenKeyExW

 regkey_r: Software\Microsoft\Windows\CurrentVersion\Uninstall\Apollo_is1
base_handle: 0x80000002
key_handle: 0x00000000
options: 0
access: 0x00000001
regkey: HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Uninstall\Apollo_is1
2 0
host 103.70.5.247
MicroWorld-eScan Trojan.GenericKD.46536218
McAfee Artemis!B7AB9BE4936D
Sangfor Trojan.Win32.Wacatac.B
Cybereason malicious.4936d5
Arcabit Trojan.Heur.RP.ED113FA
Cyren W32/Trojan.KBJH-7099
Paloalto generic.ml
BitDefender Trojan.GenericKD.46536218
Avast Win32:Malware-gen
Ad-Aware Trojan.GenericKD.46536218
Comodo TrojWare.Win32.Agent.vehpz@0
DrWeb Trojan.Packed.1278
McAfee-GW-Edition BehavesLike.Win32.Dropper.vc
FireEye Trojan.GenericKD.46536218
Emsisoft Trojan.GenericKD.46536218 (B)
Ikarus Trojan.Crypt
Webroot W32.Trojan.Gen
Avira TR/Crypt.XPACK.Gen
Microsoft Trojan:Win32/Wacatac.B!ml
AegisLab Trojan.Win32.LcZii.4!c
GData Trojan.GenericKD.46536218
BitDefenderTheta AI:Packer.266191D21F
MAX malware (ai score=89)
VBA32 Trojan.Packed
Malwarebytes Malware.AI.672424361
Tencent Win32.Trojan.Crypt.Pgwp
eGambit Unsafe.AI_Score_88%
Fortinet W32/PossibleThreat
AVG Win32:Malware-gen