Summary | ZeroBOX

Category	Machine	Started	Completed
FILE	s1_win7_x6401	July 2, 2021, 4:53 p.m.	July 2, 2021, 4:55 p.m.

Size	6.0MB
Type	PE32 executable (GUI) Intel 80386, for MS Windows
MD5	`45149d3d37ac7489767eef18b3feb96b`
SHA256	`da57991af6384a2ca4ca947f471a8f56a0cb5078656c23cf4d76180284d55ffa`
CRC32	`F7E0CF8F`
ssdeep	`196608:VTNebi35zFQ6tQeUTwhHgUGJCXVG9wXXrh:VTNuaxFWTwApJCXVR`
Yara	Win32_Trojan_Gen_1_0904B0_Zero - Win32 Trojan Emotet PE_Header_Zero - PE File Signature Generic_Malware_Zero - Generic Malware OS_Processor_Check_Zero - OS Processor Check IsPE32 - (no description) Win32_Trojan_Emotet_2_Zero - Win32 Trojan Emotet Admin_Tool_IN_Zero - Admin Tool Sysinternals

setup_dmysqd02.exe "C:\Users\test22\AppData\Local\Temp\setup_dmysqd02.exe"
1108
explorer.exe C:\Windows\Explorer.EXE
1848

Name	Response	Post-Analysis Lookup
ip.taobao.com	CNAME na61-na62.wagbridge.alibaba.taobao.com.gds.alibabadns.com CNAME na61-na62.wagbridge.alibaba.taobao.com A 203.119.175.212	203.119.144.58
softlog.xiaota.com	A 123.206.5.93	123.206.5.93
i.doumaibiji.cn	A 123.206.5.93	123.206.5.93

IP Address	Status	Action
123.206.5.93	Active	Moloch
164.124.101.2	Active	Moloch
203.119.175.212	Active	Moloch

Suricata Alerts

No Suricata Alerts

Suricata TLS

No Suricata TLS

Checks amount of memory in system, this can be used to detect virtual machines that have a low amount of memory available (1 event)

Time & API	Arguments	Status	Return	Repeated
GlobalMemoryStatusEx July 2, 2021, 4:53 p.m.		1	1	0

The executable contains unknown PE section names indicative of a packer (could be a false positive) (1 event)

section

.itext

One or more processes crashed (3 events)

Time & API	Arguments	Status
__exception__ July 2, 2021, 4:53 p.m.	stacktrace: beepdl_dltext-0x263 beepdl+0x2e595 @ 0x21ce595 beepdl_dltext+0x41 beepdl_dlfile-0x5b beepdl+0x2e839 @ 0x21ce839 setup_dmysqd02+0xb3926 @ 0x4b3926 setup_dmysqd02+0xb5a10 @ 0x4b5a10 setup_dmysqd02+0x11091a @ 0x51091a setup_dmysqd02+0xae67e @ 0x4ae67e setup_dmysqd02+0xad497 @ 0x4ad497 setup_dmysqd02+0x111803 @ 0x511803 setup_dmysqd02+0xf3bf2 @ 0x4f3bf2 setup_dmysqd02+0x15ef44 @ 0x55ef44 BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x757333ca RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x773d9ed2 RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x773d9ea5 exception.instruction_r: c9 c2 10 00 cc cc cc cc cc 8b ff 55 8b ec 56 8b exception.symbol: RaiseException+0x58 CloseHandle-0x9 kernelbase+0xb727 exception.instruction: leave exception.module: KERNELBASE.dll exception.exception_code: 0xeedfade exception.offset: 46887 exception.address: 0x76a7b727 registers.esp: 1636872 registers.edi: 42934072 registers.eax: 1636872 registers.ebp: 1636952 registers.edx: 0 registers.ebx: 0 registers.esi: 42928916 registers.ecx: 7	1
__exception__ July 2, 2021, 4:53 p.m.	stacktrace: beepdl_dltext-0x263 beepdl+0x2e595 @ 0x21ce595 beepdl_dltext+0x41 beepdl_dlfile-0x5b beepdl+0x2e839 @ 0x21ce839 setup_dmysqd02+0xb3926 @ 0x4b3926 setup_dmysqd02+0xb5a10 @ 0x4b5a10 setup_dmysqd02+0x11091a @ 0x51091a setup_dmysqd02+0xae67e @ 0x4ae67e setup_dmysqd02+0xad497 @ 0x4ad497 setup_dmysqd02+0x111803 @ 0x511803 setup_dmysqd02+0xf3bf2 @ 0x4f3bf2 setup_dmysqd02+0x15ef44 @ 0x55ef44 BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x757333ca RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x773d9ed2 RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x773d9ea5 exception.instruction_r: c9 c2 10 00 cc cc cc cc cc 8b ff 55 8b ec 56 8b exception.symbol: RaiseException+0x58 CloseHandle-0x9 kernelbase+0xb727 exception.instruction: leave exception.module: KERNELBASE.dll exception.exception_code: 0xeedfade exception.offset: 46887 exception.address: 0x76a7b727 registers.esp: 1636872 registers.edi: 42938020 registers.eax: 1636872 registers.ebp: 1636952 registers.edx: 0 registers.ebx: 0 registers.esi: 42928916 registers.ecx: 7	1
__exception__ July 2, 2021, 4:53 p.m.	stacktrace: beepdl_dltext-0x263 beepdl+0x2e595 @ 0x21ce595 beepdl_dltext+0x41 beepdl_dlfile-0x5b beepdl+0x2e839 @ 0x21ce839 setup_dmysqd02+0xb3926 @ 0x4b3926 setup_dmysqd02+0xb5a10 @ 0x4b5a10 setup_dmysqd02+0x11091a @ 0x51091a setup_dmysqd02+0xae67e @ 0x4ae67e setup_dmysqd02+0xad497 @ 0x4ad497 setup_dmysqd02+0x111803 @ 0x511803 setup_dmysqd02+0xf3bf2 @ 0x4f3bf2 setup_dmysqd02+0x15ef44 @ 0x55ef44 BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x757333ca RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x773d9ed2 RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x773d9ea5 exception.instruction_r: c9 c2 10 00 cc cc cc cc cc 8b ff 55 8b ec 56 8b exception.symbol: RaiseException+0x58 CloseHandle-0x9 kernelbase+0xb727 exception.instruction: leave exception.module: KERNELBASE.dll exception.exception_code: 0xeedfade exception.offset: 46887 exception.address: 0x76a7b727 registers.esp: 1636872 registers.edi: 42938020 registers.eax: 1636872 registers.ebp: 1636952 registers.edx: 0 registers.ebx: 0 registers.esi: 42928916 registers.ecx: 7	1

Time & API

Arguments

Status

Return

Repeated

__exception__

July 2, 2021, 4:53 p.m.

stacktrace:

beepdl_dltext-0x263 beepdl+0x2e595 @ 0x21ce595
beepdl_dltext+0x41 beepdl_dlfile-0x5b beepdl+0x2e839 @ 0x21ce839
setup_dmysqd02+0xb3926 @ 0x4b3926
setup_dmysqd02+0xb5a10 @ 0x4b5a10
setup_dmysqd02+0x11091a @ 0x51091a
setup_dmysqd02+0xae67e @ 0x4ae67e
setup_dmysqd02+0xad497 @ 0x4ad497
setup_dmysqd02+0x111803 @ 0x511803
setup_dmysqd02+0xf3bf2 @ 0x4f3bf2
setup_dmysqd02+0x15ef44 @ 0x55ef44
BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x757333ca
RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x773d9ed2
RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x773d9ea5

exception.instruction_r: c9 c2 10 00 cc cc cc cc cc 8b ff 55 8b ec 56 8b
exception.symbol: RaiseException+0x58 CloseHandle-0x9 kernelbase+0xb727
exception.instruction: leave
exception.module: KERNELBASE.dll
exception.exception_code: 0xeedfade
exception.offset: 46887
exception.address: 0x76a7b727
registers.esp: 1636872
registers.edi: 42934072
registers.eax: 1636872
registers.ebp: 1636952
registers.edx: 0
registers.ebx: 0
registers.esi: 42928916
registers.ecx: 7

__exception__

July 2, 2021, 4:53 p.m.

stacktrace:

beepdl_dltext-0x263 beepdl+0x2e595 @ 0x21ce595
beepdl_dltext+0x41 beepdl_dlfile-0x5b beepdl+0x2e839 @ 0x21ce839
setup_dmysqd02+0xb3926 @ 0x4b3926
setup_dmysqd02+0xb5a10 @ 0x4b5a10
setup_dmysqd02+0x11091a @ 0x51091a
setup_dmysqd02+0xae67e @ 0x4ae67e
setup_dmysqd02+0xad497 @ 0x4ad497
setup_dmysqd02+0x111803 @ 0x511803
setup_dmysqd02+0xf3bf2 @ 0x4f3bf2
setup_dmysqd02+0x15ef44 @ 0x55ef44
BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x757333ca
RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x773d9ed2
RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x773d9ea5

exception.instruction_r: c9 c2 10 00 cc cc cc cc cc 8b ff 55 8b ec 56 8b
exception.symbol: RaiseException+0x58 CloseHandle-0x9 kernelbase+0xb727
exception.instruction: leave
exception.module: KERNELBASE.dll
exception.exception_code: 0xeedfade
exception.offset: 46887
exception.address: 0x76a7b727
registers.esp: 1636872
registers.edi: 42938020
registers.eax: 1636872
registers.ebp: 1636952
registers.edx: 0
registers.ebx: 0
registers.esi: 42928916
registers.ecx: 7

__exception__

July 2, 2021, 4:53 p.m.

stacktrace:

beepdl_dltext-0x263 beepdl+0x2e595 @ 0x21ce595
beepdl_dltext+0x41 beepdl_dlfile-0x5b beepdl+0x2e839 @ 0x21ce839
setup_dmysqd02+0xb3926 @ 0x4b3926
setup_dmysqd02+0xb5a10 @ 0x4b5a10
setup_dmysqd02+0x11091a @ 0x51091a
setup_dmysqd02+0xae67e @ 0x4ae67e
setup_dmysqd02+0xad497 @ 0x4ad497
setup_dmysqd02+0x111803 @ 0x511803
setup_dmysqd02+0xf3bf2 @ 0x4f3bf2
setup_dmysqd02+0x15ef44 @ 0x55ef44
BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x757333ca
RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x773d9ed2
RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x773d9ea5

exception.instruction_r: c9 c2 10 00 cc cc cc cc cc 8b ff 55 8b ec 56 8b
exception.symbol: RaiseException+0x58 CloseHandle-0x9 kernelbase+0xb727
exception.instruction: leave
exception.module: KERNELBASE.dll
exception.exception_code: 0xeedfade
exception.offset: 46887
exception.address: 0x76a7b727
registers.esp: 1636872
registers.edi: 42938020
registers.eax: 1636872
registers.ebp: 1636952
registers.edx: 0
registers.ebx: 0
registers.esi: 42928916
registers.ecx: 7

HTTP traffic contains suspicious features which may be indicative of malware related traffic (3 events)

suspicious_features	HTTP version 1.0 used	suspicious_request	GET http://ip.taobao.com/service/getIpInfo.php?ip=myip
suspicious_features	HTTP version 1.0 used	suspicious_request	GET http://i.doumaibiji.cn/note/read.php/t_slt/d_2018052111/mid_94DE278C3274/n_doumainote/c_dmysqd02.gif
suspicious_features	POST method with no referer header, HTTP version 1.0 used	suspicious_request	POST http://softlog.xiaota.com/api/pushdata

Performs some HTTP requests (3 events)

request	GET http://ip.taobao.com/service/getIpInfo.php?ip=myip
request	GET http://i.doumaibiji.cn/note/read.php/t_slt/d_2018052111/mid_94DE278C3274/n_doumainote/c_dmysqd02.gif
request	POST http://softlog.xiaota.com/api/pushdata

Sends data using the HTTP POST Method (1 event)

request

POST http://softlog.xiaota.com/api/pushdata

Allocates read-write-execute memory (usually to unpack itself) (2 events)

Time & API	Arguments	Status	Return	Repeated
NtProtectVirtualMemory July 2, 2021, 4:53 p.m.	process_identifier: 1108 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x72972000 process_handle: 0xffffffff	1	0	0
NtAllocateVirtualMemory July 2, 2021, 4:53 p.m.	process_identifier: 1108 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x003d0000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1	0	0

Queries the disk size which could be used to detect virtual machine with small fixed size or dynamic allocation (1 event)

Time & API	Arguments	Status	Return	Repeated
GetDiskFreeSpaceExW July 2, 2021, 4:54 p.m.	total_number_of_free_bytes: 13721989120 free_bytes_available: 13721989120 root_path: C:\ total_number_of_bytes: 34252779520	1	1	0

Checks for known Chinese AV sofware registry keys (2 events)

regkey	.*360Safe
regkey	.*Kingsoft

Creates executable files on the filesystem (5 events)

file	C:\Users\test22\AppData\Local\Temp\is-FC7KQ.tmp\Ksicfg.dll
file	C:\Users\test22\AppData\Local\Temp\is-FC7KQ.tmp\WListViewEx.dll
file	C:\Users\test22\AppData\Local\Temp\is-FC7KQ.tmp\ksicall.dll
file	C:\Users\test22\AppData\Local\Temp\is-FC7KQ.tmp\webctrl.dll
file	C:\Users\test22\AppData\Local\Temp\is-FC7KQ.tmp\beepdl.dll

Drops an executable to the user AppData folder (5 events)

file	C:\Users\test22\AppData\Local\Temp\is-FC7KQ.tmp\beepdl.dll
file	C:\Users\test22\AppData\Local\Temp\is-FC7KQ.tmp\WListViewEx.dll
file	C:\Users\test22\AppData\Local\Temp\is-FC7KQ.tmp\Ksicfg.dll
file	C:\Users\test22\AppData\Local\Temp\is-FC7KQ.tmp\ksicall.dll
file	C:\Users\test22\AppData\Local\Temp\is-FC7KQ.tmp\webctrl.dll

Queries for potentially installed applications (5 events)

Time & API	Arguments	Return
RegOpenKeyExW July 2, 2021, 4:53 p.m.	regkey_r: SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\ÃÀÆ¼µçÄÔ°²È«ÎÀÊ¿ base_handle: 0x80000002 key_handle: 0x00000000 options: 0 access: 0x00000001 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\ÃÀÆ¼µçÄÔ°²È«ÎÀÊ¿	2
RegOpenKeyExW July 2, 2021, 4:53 p.m.	regkey_r: SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\ÃÀÆ¼µçÄÔ°²È«ÎÀÊ¿ base_handle: 0x80000002 key_handle: 0x00000000 options: 0 access: 0x00000001 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\ÃÀÆ¼µçÄÔ°²È«ÎÀÊ¿	2
RegOpenKeyExW July 2, 2021, 4:53 p.m.	regkey_r: Software\Microsoft\Windows\CurrentVersion\Uninstall\doumainote_is1 base_handle: 0x80000001 key_handle: 0x00000000 options: 0 access: 0x00000001 regkey: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Uninstall\doumainote_is1	2
RegOpenKeyExW July 2, 2021, 4:53 p.m.	regkey_r: Software\Microsoft\Windows\CurrentVersion\Uninstall\doumainote_is1 base_handle: 0x80000002 key_handle: 0x00000000 options: 0 access: 0x00000001 regkey: HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Uninstall\doumainote_is1	2
RegOpenKeyExW July 2, 2021, 4:53 p.m.	regkey_r: SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\¶¹Âó±Ê¼Ç_is1 base_handle: 0x80000002 key_handle: 0x00000000 options: 0 access: 0x00000001 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\¶¹Âó±Ê¼Ç_is1	2

Connects to an IP address that is no longer responding to requests (legitimate services will remain up-and-running usually) (1 event)

dead_host

192.168.56.101:49226

File has been identified by 40 AntiVirus engines on VirusTotal as malicious (40 events)

Bkav	W32.AIDetectVM.malware1
Elastic	malicious (high confidence)
DrWeb	Adware.WDJiange.54
FireEye	Generic.mg.45149d3d37ac7489
McAfee	Artemis!45149D3D37AC
Cylance	Unsafe
Sangfor	Malware
K7AntiVirus	Unwanted-Program ( 00516a1d1 )
Alibaba	Packed:Win32/INNOmod.a8ac1559
K7GW	Unwanted-Program ( 00516a1d1 )
CrowdStrike	win/malicious_confidence_80% (D)
Cyren	W32/Delf_Troj.W.gen!Eldorado
Symantec	ML.Attribute.HighConfidence
APEX	Malicious
Kaspersky	not-a-virus:HEUR:Downloader.Win32.Generic
NANO-Antivirus	Trojan.Win32.WDJiange.fcskqj
Comodo	ApplicUnwnt@#1ct7xhftgq1uw
F-Secure	Heuristic.HEUR/AGEN.1108449
McAfee-GW-Edition	Artemis!Trojan
Sophos	Generic PUA BK (PUA)
Ikarus	PUA.INNOmod
Jiangmin	Downloader.Generic0.a
Webroot	W32.Adware.Gen
Avira	HEUR/AGEN.1108449
MAX	malware (ai score=51)
Antiy-AVL	RiskWare[Downloader]/Win32.AGeneric
Gridinsoft	Adware.Gen.dd!c
Microsoft	PUA:Win32/GameBox
ZoneAlarm	not-a-virus:HEUR:Downloader.Win32.Generic
Cynet	Malicious (score: 100)
VBA32	BScope.Adware.WDJiange
ESET-NOD32	a variant of Win32/Packed.INNOmod.D suspicious
Rising	Adware.Agent!1.BA30 (CLASSIC)
Yandex	PUA.Downloader!UyQXNcPJHsY
SentinelOne	Static AI - Suspicious PE
eGambit	Unsafe.AI_Score_99%
Fortinet	W32/Injector.EGXE!tr
AVG	FileRepMalware [PUP]
Cybereason	malicious.f4a0a5
Panda	Trj/Genetic.gen

setup_dmysqd02.exe

Process Tree Toggle all

Network Toggle all

Suricata Toggle all

Suricata Alerts

Suricata TLS

Signatures Toggle All