popup
Summary | ZeroBOX
  1. Home
  2. Result
  3. Report
  4. Detail Analysis

lv.exe

Gen1 Emotet UPX Malicious Library Malicious Packer Downloader HTTP ScreenShot Create Service KeyLogger Internet API P2P DGA Hijack Network Http API persistence FTP Socket Escalate priviledges DNS Code injection Sniff Audio Steal credential
  1. Resubmit sample
Category Machine Started Completed
FILE s1_win7_x6402 Aug. 11, 2021, 9:25 a.m. Aug. 11, 2021, 9:51 a.m.
Size 1.2MB
Type PE32 executable (GUI) Intel 80386, for MS Windows
MD5 f8420cad9886537d355d8f2712a7c8da
SHA256 a4ea700b81162fffa25eea3aefe0d4118601ae8acd0123f08e487c4c8bc0ad84
CRC32 56CF9FFB
ssdeep 24576:N/O1ZB9xBF+di6U3atJliqn5hqiKEAAE9XKmdLe5tb+z:RO1ZXFko3+DV5hnKEfH6Sb+z
Yara
  • Malicious_Library_Zero - Malicious_Library
  • PE_Header_Zero - PE File Signature
  • IsPE32 - (no description)

Name Response Post-Analysis Lookup
rOWRSrwRCiLxceKruqgWwH.rOWRSrwRCiLxceKruqgWwH
IP Address Status Action
164.124.101.2 Active Moloch

Suricata Alerts

No Suricata Alerts

Suricata TLS

No Suricata TLS

Time & API Arguments Status Return Repeated

IsDebuggerPresent

 0 0

IsDebuggerPresent

 0 0

IsDebuggerPresent

 0 0
Time & API Arguments Status Return Repeated

WriteConsoleW

 buffer: Microsoft Windows [Version 6.1.7601]
console_handle: 0x00000007
1 1 0

WriteConsoleW

 buffer: Copyright (c) 2009 Microsoft Corporation. All rights reserved.
console_handle: 0x00000007
1 1 0

WriteConsoleW

 buffer: C:\Users\test22\AppData\Local\Temp\IXP000.TMP>
console_handle: 0x00000007
1 1 0

WriteConsoleW

 buffer: Set YgSxKtFDTmVErLNiJGvhjPyQwU=DESKTOP-
console_handle: 0x00000007
1 1 0

WriteConsoleW

 buffer: C:\Users\test22\AppData\Local\Temp\IXP000.TMP>
console_handle: 0x00000007
1 1 0

WriteConsoleW

 buffer: Set SyrbhHgIBjgOLndipEqGLMI=QO5QU33
console_handle: 0x00000007
1 1 0

WriteConsoleW

 buffer: C:\Users\test22\AppData\Local\Temp\IXP000.TMP>
console_handle: 0x00000007
1 1 0

WriteConsoleW

 buffer: Set uWrRJmOLfaXnBkR=ping localhost -n
console_handle: 0x00000007
1 1 0

WriteConsoleW

 buffer: C:\Users\test22\AppData\Local\Temp\IXP000.TMP>
console_handle: 0x00000007
1 1 0

WriteConsoleW

 buffer: if %computername%==%YgSxKtFDTmVErLNiJGvhjPyQwU% uWrRJmOLfaXnBkR 300
console_handle: 0x00000007
1 1 0

WriteConsoleW

 buffer: C:\Users\test22\AppData\Local\Temp\IXP000.TMP>
console_handle: 0x00000007
1 1 0

WriteConsoleW

 buffer: Set cPGaIQeXVPHPiwOwl=MZ
console_handle: 0x00000007
1 1 0

WriteConsoleW

 buffer: C:\Users\test22\AppData\Local\Temp\IXP000.TMP>
console_handle: 0x00000007
1 1 0

WriteConsoleW

 buffer: <nul set /p = "%cPGaIQeXVPHPiwOwl%" > Esistenza.exe.com
console_handle: 0x00000007
1 1 0

WriteConsoleW

 buffer: C:\Users\test22\AppData\Local\Temp\IXP000.TMP>
console_handle: 0x00000007
1 1 0

WriteConsoleW

 buffer: findstr /V /R "^riubUwhJVBcAWxPbDOSEYgKBaLKelDDKVoOIIXjPsUNHnzwOpkOcJtQPbFyodknaYLENFuOFCehtBeeYKVTZOiqQaZkrRrnucxJNOhoevoTGRLhxDunxsmDQKNcGULNnEuIuzg$" Poi.tif >> Esistenza.exe.com"
console_handle: 0x00000007
1 1 0

WriteConsoleW

 buffer: C:\Users\test22\AppData\Local\Temp\IXP000.TMP>
console_handle: 0x00000007
1 1 0

WriteConsoleW

 buffer: copy Ove.tif Z
console_handle: 0x00000007
1 1 0

WriteConsoleW

 buffer: 1 file(s) copied.
console_handle: 0x00000007
1 1 0

WriteConsoleW

 buffer: C:\Users\test22\AppData\Local\Temp\IXP000.TMP>
console_handle: 0x00000007
1 1 0

WriteConsoleW

 buffer: start Esistenza.exe.com Z
console_handle: 0x00000007
1 1 0

WriteConsoleW

 buffer: C:\Users\test22\AppData\Local\Temp\IXP000.TMP>
console_handle: 0x00000007
1 1 0

WriteConsoleW

 buffer: %uWrRJmOLfaXnBkR% 30
console_handle: 0x00000007
1 1 0

WriteConsoleW

 buffer: C:\Users\test22\AppData\Local\Temp\IXP000.TMP>
console_handle: 0x00000007
1 1 0

WriteConsoleW

 buffer: C:\Users\test22\AppData\Local\Temp\IXP000.TMP>
console_handle: 0x00000007
1 1 0

WriteConsoleA

 buffer: Pinging test22-PC [::1]
console_handle: 0x00000007
1 1 0

WriteConsoleA

 buffer: with 32 bytes of data:
console_handle: 0x00000007
1 1 0

WriteConsoleA

 buffer: Reply from ::1:
console_handle: 0x00000007
1 1 0

WriteConsoleA

 buffer: time<1ms
console_handle: 0x00000007
1 1 0

WriteConsoleA

 buffer: Reply from ::1:
console_handle: 0x00000007
1 1 0

WriteConsoleA

 buffer: time<1ms
console_handle: 0x00000007
1 1 0

WriteConsoleA

 buffer: Reply from ::1:
console_handle: 0x00000007
1 1 0

WriteConsoleA

 buffer: time<1ms
console_handle: 0x00000007
1 1 0

WriteConsoleA

 buffer: Reply from ::1:
console_handle: 0x00000007
1 1 0

WriteConsoleA

 buffer: time<1ms
console_handle: 0x00000007
1 1 0

WriteConsoleA

 buffer: Reply from ::1:
console_handle: 0x00000007
1 1 0

WriteConsoleA

 buffer: time<1ms
console_handle: 0x00000007
1 1 0

WriteConsoleA

 buffer: Reply from ::1:
console_handle: 0x00000007
1 1 0

WriteConsoleA

 buffer: time<1ms
console_handle: 0x00000007
1 1 0

WriteConsoleA

 buffer: Reply from ::1:
console_handle: 0x00000007
1 1 0

WriteConsoleA

 buffer: time<1ms
console_handle: 0x00000007
1 1 0

WriteConsoleA

 buffer: Reply from ::1:
console_handle: 0x00000007
1 1 0

WriteConsoleA

 buffer: time<1ms
console_handle: 0x00000007
1 1 0

WriteConsoleA

 buffer: Reply from ::1:
console_handle: 0x00000007
1 1 0

WriteConsoleA

 buffer: time<1ms
console_handle: 0x00000007
1 1 0

WriteConsoleA

 buffer: Reply from ::1:
console_handle: 0x00000007
1 1 0

WriteConsoleA

 buffer: time<1ms
console_handle: 0x00000007
1 1 0

WriteConsoleA

 buffer: Reply from ::1:
console_handle: 0x00000007
1 1 0

WriteConsoleA

 buffer: time<1ms
console_handle: 0x00000007
1 1 0

WriteConsoleA

 buffer: Reply from ::1:
console_handle: 0x00000007
1 1 0
Time & API Arguments Status Return Repeated

GlobalMemoryStatusEx

 1 1 0
section .ndata
Time & API Arguments Status Return Repeated

NtProtectVirtualMemory

 process_identifier: 2204
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x73fd1000
process_handle: 0xffffffff
1 0 0

NtProtectVirtualMemory

 process_identifier: 2204
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x76ec1000
process_handle: 0xffffffff
1 0 0

NtProtectVirtualMemory

 process_identifier: 2204
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x10001000
process_handle: 0xffffffff
1 0 0

NtProtectVirtualMemory

 process_identifier: 2204
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x73fc1000
process_handle: 0xffffffff
1 0 0

NtProtectVirtualMemory

 process_identifier: 2204
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x73e91000
process_handle: 0xffffffff
1 0 0

NtProtectVirtualMemory

 process_identifier: 2204
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x732b1000
process_handle: 0xffffffff
1 0 0

NtProtectVirtualMemory

 process_identifier: 2204
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x73e92000
process_handle: 0xffffffff
1 0 0

NtProtectVirtualMemory

 process_identifier: 2480
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x74101000
process_handle: 0xffffffff
1 0 0

NtProtectVirtualMemory

 process_identifier: 2480
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x74021000
process_handle: 0xffffffff
1 0 0

NtProtectVirtualMemory

 process_identifier: 2480
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x73f71000
process_handle: 0xffffffff
1 0 0

NtProtectVirtualMemory

 process_identifier: 2480
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x74022000
process_handle: 0xffffffff
1 0 0

NtProtectVirtualMemory

 process_identifier: 2480
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x740a1000
process_handle: 0xffffffff
1 0 0

NtProtectVirtualMemory

 process_identifier: 2480
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x740a3000
process_handle: 0xffffffff
1 0 0

NtProtectVirtualMemory

 process_identifier: 2480
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x73eb1000
process_handle: 0xffffffff
1 0 0

NtProtectVirtualMemory

 process_identifier: 1960
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
length: 90112
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x00a51000
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 1960
region_size: 155648
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x00910000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtProtectVirtualMemory

 process_identifier: 2200
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x74021000
process_handle: 0xffffffff
1 0 0

NtProtectVirtualMemory

 process_identifier: 2200
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x73f71000
process_handle: 0xffffffff
1 0 0

NtProtectVirtualMemory

 process_identifier: 2200
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x74022000
process_handle: 0xffffffff
1 0 0

NtProtectVirtualMemory

 process_identifier: 456
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x74021000
process_handle: 0xffffffff
1 0 0

NtProtectVirtualMemory

 process_identifier: 456
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x73f71000
process_handle: 0xffffffff
1 0 0

NtProtectVirtualMemory

 process_identifier: 456
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x74022000
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 456
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x03170000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtProtectVirtualMemory

 process_identifier: 456
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
length: 102400
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x03f41000
process_handle: 0xffffffff
1 0 0

NtProtectVirtualMemory

 process_identifier: 456
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
length: 32768
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x03f5a000
process_handle: 0xffffffff
1 0 0

NtProtectVirtualMemory

 process_identifier: 456
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
length: 8192
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x03f62000
process_handle: 0xffffffff
1 0 0

NtProtectVirtualMemory

 process_identifier: 456
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x03f64000
process_handle: 0xffffffff
1 0 0

NtProtectVirtualMemory

 process_identifier: 456
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
length: 8192
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x03f65000
process_handle: 0xffffffff
1 0 0
Time & API Arguments Status Return Repeated

GetDiskFreeSpaceW

 number_of_free_clusters: 2667993
sectors_per_cluster: 8
bytes_per_sector: 512
root_path: \
total_number_of_clusters: 8362495
1 1 0

GetDiskFreeSpaceW

 number_of_free_clusters: 2667993
sectors_per_cluster: 8
bytes_per_sector: 512
root_path: \
total_number_of_clusters: 8362495
1 1 0
file C:\Users\test22\AppData\Local\Temp\arose\fr.exe
file C:\Users\test22\AppData\Local\Temp\IXP000.TMP\Esistenza.exe.com
file C:\Program Files (x86)\foler\olader\acppage.dll
file C:\Users\test22\AppData\Local\Temp\nsw7885.tmp\UAC.dll
file C:\Program Files (x86)\foler\olader\acledit.dll
file C:\Program Files (x86)\foler\olader\adprovider.dll
file C:\Users\test22\AppData\Local\Temp\arose\pn.exe
file C:\Users\test22\AppData\Local\Temp\nsw7885.tmp\UAC.dll
file C:\Users\test22\AppData\Local\Temp\arose\fr.exe
file C:\Users\test22\AppData\Local\Temp\arose\pn.exe
section {u'size_of_data': u'0x00001000', u'virtual_address': u'0x00169000', u'entropy': 6.9294690391440925, u'name': u'.reloc', u'virtual_size': u'0x00000fd6'} entropy 6.92946903914 description A section with a high entropy has been found
url http://www.microsoft.com/schemas/ie8tldlistdescription/1.0
url http://purl.org/rss/1.0/
url http://www.passport.com
description Communication using DGA rule Network_DGA
description Communications use DNS rule Network_DNS
description Communications over RAW Socket rule Network_TCP_Socket
description Create a windows service rule Create_Service
description Record Audio rule Sniff_Audio
description Escalate priviledges rule Escalate_priviledges
description Run a KeyLogger rule KeyLogger
description Code injection with CreateRemoteThread in a remote process rule Code_injection
description Communications over HTTP rule Network_HTTP
description Hijack network configuration rule Hijack_Network
description Match Windows Inet API call rule Str_Win32_Internet_API
description Communications over FTP rule Network_FTP
description Take ScreenShot rule ScreenShot
description Match Windows Http API call rule Str_Win32_Http_API
description Steal credential rule local_credential_Steal
description File Downloader rule Network_Downloader
description Communications over P2P network rule Network_P2P_Win
description (no description) rule DebuggerCheck__GlobalFlags
description (no description) rule DebuggerCheck__QueryInfo
description (no description) rule DebuggerCheck__RemoteAPI
description (no description) rule DebuggerHiding__Thread
description (no description) rule DebuggerHiding__Active
description (no description) rule DebuggerException__ConsoleCtrl
description (no description) rule DebuggerException__SetConsoleCtrl
description (no description) rule ThreadControl__Context
description (no description) rule SEH__vectored
description (no description) rule Check_Dlls
description Checks if being debugged rule anti_dbg
description Anti-Sandbox checks for ThreatExpert rule antisb_threatExpert
description Bypass DEP rule disable_dep
description Affect hook table rule win_hook
description Install itself for autorun at Windows startup rule Persistence
cmdline ping localhost -n 30
file C:\ProgramData\AVAST Software
file C:\ProgramData\AVG
reg_key HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 reg_value rundll32.exe C:\Windows\system32\advpack.dll,DelNodeRunDLL32 "C:\Users\test22\AppData\Local\Temp\IXP000.TMP\"
Process injection Process 2816 resumed a thread in remote process 2200
Time & API Arguments Status Return Repeated

NtResumeThread

 thread_handle: 0x00000134
suspend_count: 0
process_identifier: 2200
1 0 0