Summary | ZeroBOX

Category	Machine	Started	Completed
FILE	s1_win7_x6402	July 2, 2021, 9:21 a.m.	July 2, 2021, 9:24 a.m.

Size	486.0KB
Type	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
MD5	`4185a656dd45d56626bc9ded66c3a7bd`
SHA256	`9a0b3a21e8932b903f9d79b948c6abf8f735746d4f4c10934f57c34726af3f3d`
CRC32	`12CC5BF7`
ssdeep	`12288:eYUqByp7YKoM2/tDnJ6JKNcelTCs8ytO1AlYd8lVI1:DUqQB/2/tLJzl/rM1AY8Xm`
Yara	IsPE32 - (no description) IsDLL - (no description) Win32_Trojan_Emotet_1_Zero - Win32 Trojan Emotet OS_Processor_Check_Zero - OS Processor Check PE_Header_Zero - PE File Signature

rundll32.exe "C:\Windows\System32\rundll32.exe" C:\Users\test22\AppData\Local\Temp\m1.dll,DllRegisterServer
6240
- wermgr.exe C:\Windows\system32\wermgr.exe
  8088
rundll32.exe "C:\Windows\System32\rundll32.exe" C:\Users\test22\AppData\Local\Temp\m1.dll,
812

Name	Response	Post-Analysis Lookup
No hosts contacted.

IP Address	Status	Action
154.58.23.192	Active	Moloch
172.217.25.14	Active	Moloch
185.56.76.108	Active	Moloch

Suricata Alerts

Flow	SID	Signature	Category
TCP 192.168.56.102:49812 -> 154.58.23.192:443	2028401	ET JA3 Hash - Possible Malware - Various Trickbot/Kovter/Dridex	Unknown Traffic
TCP 192.168.56.102:49810 -> 185.56.76.108:443	2028401	ET JA3 Hash - Possible Malware - Various Trickbot/Kovter/Dridex	Unknown Traffic
TCP 154.58.23.192:443 -> 192.168.56.102:49812	2011540	ET POLICY OpenSSL Demo CA - Internet Widgits Pty (O)	Not Suspicious Traffic
TCP 192.168.56.102:49811 -> 154.58.23.192:443	2028401	ET JA3 Hash - Possible Malware - Various Trickbot/Kovter/Dridex	Unknown Traffic
TCP 154.58.23.192:443 -> 192.168.56.102:49811	2011540	ET POLICY OpenSSL Demo CA - Internet Widgits Pty (O)	Not Suspicious Traffic

Suricata TLS

Flow	Issuer	Subject	Fingerprint
TLSv1 192.168.56.102:49812 154.58.23.192:443	C=AU, ST=Some-State, O=Internet Widgits Pty Ltd	C=AU, ST=Some-State, O=Internet Widgits Pty Ltd	50:fd:fd:4e:2c:57:ea:f7:c9:cd:3f:61:4a:a2:40:01:1b:b8:df:02
TLSv1 192.168.56.102:49810 185.56.76.108:443	C=US, ST=CA, L=San Jose, O=Ubiquiti Networks Inc., OU=Technical Support, CN=UBNT-78:8A:20:CC:52:47/emailAddress=support@ubnt.com	C=US, ST=CA, L=San Jose, O=Ubiquiti Networks Inc., OU=Technical Support, CN=UBNT-78:8A:20:CC:52:47/emailAddress=support@ubnt.com	d6:b9:fb:f6:d3:46:bd:b4:fb:8e:3e:15:46:aa:1d:93:85:15:ad:74
TLSv1 192.168.56.102:49811 154.58.23.192:443	C=AU, ST=Some-State, O=Internet Widgits Pty Ltd	C=AU, ST=Some-State, O=Internet Widgits Pty Ltd	50:fd:fd:4e:2c:57:ea:f7:c9:cd:3f:61:4a:a2:40:01:1b:b8:df:02

Queries for the computername (1 event)

Time & API	Arguments	Status	Return	Repeated
GetComputerNameW July 2, 2021, 9:22 a.m.	computer_name: TEST22-PC	1	1	0

Checks if process is being debugged by a debugger (1 event)

Time & API	Arguments	Status	Return	Repeated
IsDebuggerPresent July 2, 2021, 9:21 a.m.			0	0

The file contains an unknown PE resource name possibly indicative of a packer (1 event)

resource name

None

One or more potentially interesting buffers were extracted, these generally contain injected code, configuration data, etc.

HTTP traffic contains suspicious features which may be indicative of malware related traffic (4 events)

suspicious_features	Connection to IP address	suspicious_request	GET https://185.56.76.108/sat2/TEST22-PC_W617601.3D2BFF7FC21FE95BBF87D9D63377961F/5/file/
suspicious_features	Connection to IP address	suspicious_request	GET https://185.56.76.108/cookiechecker?uri=/sat2/TEST22-PC_W617601.3D2BFF7FC21FE95BBF87D9D63377961F/5/file/
suspicious_features	Connection to IP address	suspicious_request	GET https://185.56.76.108/index.html
suspicious_features	Connection to IP address	suspicious_request	GET https://185.56.76.108/login.cgi?uri=/index.html

Performs some HTTP requests (4 events)

request	GET https://185.56.76.108/sat2/TEST22-PC_W617601.3D2BFF7FC21FE95BBF87D9D63377961F/5/file/
request	GET https://185.56.76.108/cookiechecker?uri=/sat2/TEST22-PC_W617601.3D2BFF7FC21FE95BBF87D9D63377961F/5/file/
request	GET https://185.56.76.108/index.html
request	GET https://185.56.76.108/login.cgi?uri=/index.html

Allocates read-write-execute memory (usually to unpack itself) (19 events)

Time & API	Arguments	Status	Return
NtProtectVirtualMemory July 2, 2021, 9:21 a.m.	process_identifier: 6240 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x1002d000 process_handle: 0xffffffff	1	0
NtProtectVirtualMemory July 2, 2021, 9:21 a.m.	process_identifier: 6240 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x73e80000 process_handle: 0xffffffff	1	0
NtProtectVirtualMemory July 2, 2021, 9:21 a.m.	process_identifier: 6240 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x73771000 process_handle: 0xffffffff	1	0
NtProtectVirtualMemory July 2, 2021, 9:21 a.m.	process_identifier: 6240 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x73861000 process_handle: 0xffffffff	1	0
NtProtectVirtualMemory July 2, 2021, 9:21 a.m.	process_identifier: 6240 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x72da4000 process_handle: 0xffffffff	1	0
NtProtectVirtualMemory July 2, 2021, 9:21 a.m.	process_identifier: 6240 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x73772000 process_handle: 0xffffffff	1	0
NtProtectVirtualMemory July 2, 2021, 9:21 a.m.	process_identifier: 6240 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x73e01000 process_handle: 0xffffffff	1	0
NtAllocateVirtualMemory July 2, 2021, 9:21 a.m.	process_identifier: 6240 region_size: 229376 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00860000 allocation_type: 12289 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0xffffffff	1	0
NtProtectVirtualMemory July 2, 2021, 9:21 a.m.	process_identifier: 6240 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x743f1000 process_handle: 0xffffffff	1	0
NtProtectVirtualMemory July 2, 2021, 9:21 a.m.	process_identifier: 6240 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x73c91000 process_handle: 0xffffffff	1	0
NtAllocateVirtualMemory July 2, 2021, 9:21 a.m.	process_identifier: 6240 region_size: 274432 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00a10000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1	0
NtAllocateVirtualMemory July 2, 2021, 9:21 a.m.	process_identifier: 6240 region_size: 12288 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00920000 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0xffffffff	1	0
NtAllocateVirtualMemory July 2, 2021, 9:21 a.m.	process_identifier: 6240 region_size: 12288 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x10000000 allocation_type: 8192 (MEM_RESERVE) process_handle: 0xffffffff		3221225496
NtAllocateVirtualMemory July 2, 2021, 9:21 a.m.	process_identifier: 6240 region_size: 12288 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x009b0000 allocation_type: 8192 (MEM_RESERVE) process_handle: 0xffffffff	1	0
NtAllocateVirtualMemory July 2, 2021, 9:21 a.m.	process_identifier: 6240 region_size: 8192 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x009b1000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1	0
NtAllocateVirtualMemory July 2, 2021, 9:21 a.m.	process_identifier: 6240 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x009c0000 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0xffffffff	1	0
NtAllocateVirtualMemory July 2, 2021, 9:21 a.m.	process_identifier: 6240 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00a60000 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0xffffffff	1	0
NtAllocateVirtualMemory July 2, 2021, 9:21 a.m.	process_identifier: 6240 region_size: 163840 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00a90000 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0xffffffff	1	0
NtAllocateVirtualMemory July 2, 2021, 9:21 a.m.	process_identifier: 8088 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0000000001bc0000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1	0

A process attempted to delay the analysis task. (1 event)

description

wermgr.exe tried to sleep 145 seconds, actually delayed analysis time by 145 seconds

Creates a suspicious process (1 event)

cmdline

C:\Windows\system32\cmd.exe

Changes read-write memory protection to read-execute (probably to avoid detection when setting all RWX flags at the same time) (1 event)

Time & API	Arguments	Status	Return	Repeated
NtProtectVirtualMemory July 2, 2021, 9:21 a.m.	process_identifier: 6240 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 length: 8192 protection: 32 (PAGE_EXECUTE_READ) base_address: 0x008e1000 process_handle: 0xffffffff	1	0	0

Checks adapter addresses which can be used to detect virtual network interfaces (1 event)

Time & API	Arguments	Status	Return	Repeated
GetAdaptersAddresses July 2, 2021, 9:22 a.m.	flags: 15 family: 0		111	0

The binary likely contains encrypted or compressed data indicative of a packer (2 events)

section

{u'size_of_data': u'0x00039c00', u'virtual_address': u'0x0003e000', u'entropy': 7.973784324759668, u'name': u'.rsrc', u'virtual_size': u'0x00039b7c'}

entropy

7.97378432476

description

A section with a high entropy has been found

entropy

0.476288659794

description

Overall entropy of this PE file is high

Checks for the Locally Unique Identifier on the system for a suspicious privilege (1 event)

Time & API	Arguments	Status	Return	Repeated
LookupPrivilegeValueW July 2, 2021, 9:22 a.m.	system_name: privilege_name: SeDebugPrivilege	1	1	0

Terminates another process (2 events)

Time & API	Arguments	Status	Return	Repeated
NtTerminateProcess July 2, 2021, 9:21 a.m.	status_code: 0x00000000 process_identifier: 7636 process_handle: 0x00000108		0	0
NtTerminateProcess July 2, 2021, 9:21 a.m.	status_code: 0x00000000 process_identifier: 7636 process_handle: 0x00000108	1	0	0

Communicates with host for which no DNS query was performed (3 events)

host	154.58.23.192
host	172.217.25.14
host	185.56.76.108

File has been identified by 10 AntiVirus engines on VirusTotal as malicious (10 events)

Elastic	malicious (high confidence)
CrowdStrike	win/malicious_confidence_60% (D)
APEX	Malicious
Avast	FileRepMalware
Kaspersky	UDS:DangerousObject.Multi.Generic
Paloalto	generic.ml
FireEye	Generic.mg.4185a656dd45d566
Microsoft	Trojan:Win32/Woreflint.A!cl
ZoneAlarm	UDS:DangerousObject.Multi.Generic
AVG	FileRepMalware

m1.dll

Process Tree Toggle all

Network Toggle all

Suricata Toggle all

Suricata Alerts

Suricata TLS

Signatures Toggle All