Summary | ZeroBOX

Category	Machine	Started	Completed
FILE	s1_win7_x6402	July 1, 2021, 8:29 a.m.	July 1, 2021, 8:32 a.m.

Size	1.6MB
Type	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
MD5	`18c3793f2df5ae48b55a9a1825b1c1fb`
SHA256	`43e35aa1486b2cd51237520eb1b0b02fb46f0f3b135622e66b7438684429441c`
CRC32	`6136CF14`
ssdeep	`24576:L3G8qqDn4HT28T14a5EhXn6LLdHr/CLn+/nfwoeCOUgFqmRCka/2qp5e+l8U3h:iiYTtwaLdHryn+ZRg5rqJ3`
PDB Path	c:\morning\bone\claim-front\Baby\Planet.pdb
Yara	IsDLL - (no description) Generic_Malware_Zero - Generic Malware IsPE32 - (no description) PE_Header_Zero - PE File Signature

rundll32.exe "C:\Windows\System32\rundll32.exe" C:\Users\test22\AppData\Local\Temp\idu567.tmp.dll,Country
2616
- WerFault.exe C:\Windows\system32\WerFault.exe
  7908
rundll32.exe "C:\Windows\System32\rundll32.exe" C:\Users\test22\AppData\Local\Temp\idu567.tmp.dll,Raildiffer
7680
- WerFault.exe C:\Windows\system32\WerFault.exe
  7012
rundll32.exe "C:\Windows\System32\rundll32.exe" C:\Users\test22\AppData\Local\Temp\idu567.tmp.dll,Sleephappen
7636
- WerFault.exe C:\Windows\system32\WerFault.exe
  8408
rundll32.exe "C:\Windows\System32\rundll32.exe" C:\Users\test22\AppData\Local\Temp\idu567.tmp.dll,Whatgrand
8752
- WerFault.exe C:\Windows\system32\WerFault.exe
  8700
rundll32.exe "C:\Windows\System32\rundll32.exe" C:\Users\test22\AppData\Local\Temp\idu567.tmp.dll,
4384

Name	Response	Post-Analysis Lookup
No hosts contacted.

IP Address	Status	Action
172.217.25.14	Active	Moloch
172.241.27.226	Active	Moloch

Suricata Alerts

No Suricata Alerts

Suricata TLS

No Suricata TLS

Queries for the computername (11 events)

Time & API	Arguments	Status	Return
GetComputerNameW July 1, 2021, 8:30 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameW July 1, 2021, 8:30 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameW July 1, 2021, 8:30 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameW July 1, 2021, 8:30 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameW July 1, 2021, 8:23 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameW July 1, 2021, 8:23 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameW July 1, 2021, 8:23 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameW July 1, 2021, 8:23 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameW July 1, 2021, 8:23 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameW July 1, 2021, 8:23 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameW July 1, 2021, 8:23 a.m.	computer_name: TEST22-PC	1	1

This executable has a PDB path (1 event)

pdb_path

c:\morning\bone\claim-front\Baby\Planet.pdb

Checks amount of memory in system, this can be used to detect virtual machines that have a low amount of memory available (1 event)

Time & API	Arguments	Status	Return	Repeated
GlobalMemoryStatusEx July 1, 2021, 8:23 a.m.		1	1	0

Allocates read-write-execute memory (usually to unpack itself) (20 events)

Time & API	Arguments	Status
NtProtectVirtualMemory July 1, 2021, 8:29 a.m.	process_identifier: 2616 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x708d3000 process_handle: 0xffffffff	1
NtProtectVirtualMemory July 1, 2021, 8:30 a.m.	process_identifier: 2616 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 16384 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x7094c000 process_handle: 0xffffffff	1
NtAllocateVirtualMemory July 1, 2021, 8:30 a.m.	process_identifier: 2616 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00400000 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0xffffffff	1
NtAllocateVirtualMemory July 1, 2021, 8:30 a.m.	process_identifier: 2616 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00410000 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0xffffffff	1
NtAllocateVirtualMemory July 1, 2021, 8:30 a.m.	process_identifier: 2616 region_size: 1253376 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x01f00000 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0xffffffff	1
NtProtectVirtualMemory July 1, 2021, 8:29 a.m.	process_identifier: 7680 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x708d3000 process_handle: 0xffffffff	1
NtProtectVirtualMemory July 1, 2021, 8:30 a.m.	process_identifier: 7680 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 16384 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x7094c000 process_handle: 0xffffffff	1
NtAllocateVirtualMemory July 1, 2021, 8:30 a.m.	process_identifier: 7680 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x007e0000 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0xffffffff	1
NtAllocateVirtualMemory July 1, 2021, 8:30 a.m.	process_identifier: 7680 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x007f0000 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0xffffffff	1
NtAllocateVirtualMemory July 1, 2021, 8:30 a.m.	process_identifier: 7680 region_size: 1253376 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x02080000 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0xffffffff	1
NtProtectVirtualMemory July 1, 2021, 8:29 a.m.	process_identifier: 7636 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x708d3000 process_handle: 0xffffffff	1
NtProtectVirtualMemory July 1, 2021, 8:30 a.m.	process_identifier: 7636 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 16384 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x7094c000 process_handle: 0xffffffff	1
NtAllocateVirtualMemory July 1, 2021, 8:30 a.m.	process_identifier: 7636 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x007a0000 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0xffffffff	1
NtAllocateVirtualMemory July 1, 2021, 8:30 a.m.	process_identifier: 7636 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x007b0000 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0xffffffff	1
NtAllocateVirtualMemory July 1, 2021, 8:30 a.m.	process_identifier: 7636 region_size: 1253376 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x01e70000 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0xffffffff	1
NtProtectVirtualMemory July 1, 2021, 8:29 a.m.	process_identifier: 8752 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x708d3000 process_handle: 0xffffffff	1
NtProtectVirtualMemory July 1, 2021, 8:30 a.m.	process_identifier: 8752 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 16384 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x7094c000 process_handle: 0xffffffff	1
NtAllocateVirtualMemory July 1, 2021, 8:30 a.m.	process_identifier: 8752 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00340000 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0xffffffff	1
NtAllocateVirtualMemory July 1, 2021, 8:30 a.m.	process_identifier: 8752 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00350000 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0xffffffff	1
NtAllocateVirtualMemory July 1, 2021, 8:30 a.m.	process_identifier: 8752 region_size: 1253376 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x01f00000 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0xffffffff	1

Communicates with host for which no DNS query was performed (2 events)

host	172.217.25.14
host	172.241.27.226

File has been identified by 12 AntiVirus engines on VirusTotal as malicious (12 events)

Elastic	malicious (high confidence)
McAfee	Artemis!18C3793F2DF5
Sangfor	Trojan.Win32.Save.a
Paloalto	generic.ml
McAfee-GW-Edition	Artemis!Trojan
Avira	TR/AD.Carberp.xehvx
Microsoft	Program:Win32/Wacapew.C!ml
Cynet	Malicious (score: 100)
Rising	Malware.Heuristic!ET#78% (RDMK:cmRtazo91LiFut/IS3uhdUgZlraW)
SentinelOne	Static AI - Suspicious PE
Webroot	W32.Trojan.Gen
Qihoo-360	Win32/TrojanPSW.Carberp.Hx4CR9sA

idu567.tmp

Process Tree Toggle all

Network Toggle all

Suricata Toggle all

Suricata Alerts

Suricata TLS

Signatures Toggle All