popup
Summary | ZeroBOX
  1. Home
  2. Result
  3. Report
  4. Detail Analysis

lv.exe

Gen1 Emotet Malicious Library Malicious Packer Downloader HTTP ScreenShot Create Service KeyLogger Internet API P2P DGA Hijack Network Http API persistence FTP Socket Escalate priviledges DNS Code injection Sniff Audio Steal credential
  1. Resubmit sample
Category Machine Started Completed
FILE s1_win7_x6401 Aug. 21, 2021, 8:52 a.m. Aug. 21, 2021, 9:15 a.m.
Size 1.1MB
Type PE32 executable (GUI) Intel 80386, for MS Windows
MD5 ccfc289366f06bf59611aecaba901d50
SHA256 20a8ba80dc39bf96815fbe7aac15ae018c57df40e3fd75f223f31dfc20f1e61f
CRC32 709B9FF4
ssdeep 24576:z71ZOukQnPSxzxXdjT6YQJG3EtzgklajHZTRvi030ZoMgyRRoNq:v1ZORQei80tzoR9308+iNq
Yara
  • PE_Header_Zero - PE File Signature
  • Malicious_Library_Zero - Malicious_Library
  • IsPE32 - (no description)

Name Response Post-Analysis Lookup
DUJLnoInJHUNOY.DUJLnoInJHUNOY
IP Address Status Action
164.124.101.2 Active Moloch

Suricata Alerts

No Suricata Alerts

Suricata TLS

No Suricata TLS

Time & API Arguments Status Return Repeated

IsDebuggerPresent

 0 0

IsDebuggerPresent

 0 0

IsDebuggerPresent

 0 0

IsDebuggerPresent

 0 0
Time & API Arguments Status Return Repeated

WriteConsoleW

 buffer: Microsoft Windows [Version 6.1.7601]
console_handle: 0x00000007
1 1 0

WriteConsoleW

 buffer: Copyright (c) 2009 Microsoft Corporation. All rights reserved.
console_handle: 0x00000007
1 1 0

WriteConsoleW

 buffer: C:\Users\test22\AppData\Local\Temp\IXP000.TMP>
console_handle: 0x00000007
1 1 0

WriteConsoleW

 buffer: Set RbWAkcTmwfrPZXFwJzbM=DESKTOP-
console_handle: 0x00000007
1 1 0

WriteConsoleW

 buffer: C:\Users\test22\AppData\Local\Temp\IXP000.TMP>
console_handle: 0x00000007
1 1 0

WriteConsoleW

 buffer: Set SBoAYcNKKHN=QO5QU33
console_handle: 0x00000007
1 1 0

WriteConsoleW

 buffer: C:\Users\test22\AppData\Local\Temp\IXP000.TMP>
console_handle: 0x00000007
1 1 0

WriteConsoleW

 buffer: Set XWnuCwLESxdOP=ping %computername% -n
console_handle: 0x00000007
1 1 0

WriteConsoleW

 buffer: C:\Users\test22\AppData\Local\Temp\IXP000.TMP>
console_handle: 0x00000007
1 1 0

WriteConsoleW

 buffer: if %computername%==%RbWAkcTmwfrPZXFwJzbM% %XWnuCwLESxdOP% 300
console_handle: 0x00000007
1 1 0

WriteConsoleW

 buffer: C:\Users\test22\AppData\Local\Temp\IXP000.TMP>
console_handle: 0x00000007
1 1 0

WriteConsoleW

 buffer: Set JkwMGHmaLVRIlQoUZQFEHMnzRvezxiwYsdgatl=MZ
console_handle: 0x00000007
1 1 0

WriteConsoleW

 buffer: C:\Users\test22\AppData\Local\Temp\IXP000.TMP>
console_handle: 0x00000007
1 1 0

WriteConsoleW

 buffer: <nul set /p = "%JkwMGHmaLVRIlQoUZQFEHMnzRvezxiwYsdgatl%" > Tutte.exe.com
console_handle: 0x00000007
1 1 0

WriteConsoleW

 buffer: C:\Users\test22\AppData\Local\Temp\IXP000.TMP>
console_handle: 0x00000007
1 1 0

WriteConsoleW

 buffer: findstr /V /R "^IzBsFjJHxKGnIhPdWNHUpFyYEUSdTBPPPCWlucSuiPHIOIaLBqsFvftrhDNLzaNTVQIusFlBUANzYbpVBiPTppaAbTWDHiMPeN$" Dai.gif >> Tutte.exe.com"
console_handle: 0x00000007
1 1 0

WriteConsoleW

 buffer: C:\Users\test22\AppData\Local\Temp\IXP000.TMP>
console_handle: 0x00000007
1 1 0

WriteConsoleW

 buffer: copy Amo.gif L
console_handle: 0x00000007
1 1 0

WriteConsoleW

 buffer: 1 file(s) copied.
console_handle: 0x00000007
1 1 0

WriteConsoleW

 buffer: C:\Users\test22\AppData\Local\Temp\IXP000.TMP>
console_handle: 0x00000007
1 1 0

WriteConsoleW

 buffer: start Tutte.exe.com L
console_handle: 0x00000007
1 1 0

WriteConsoleW

 buffer: C:\Users\test22\AppData\Local\Temp\IXP000.TMP>
console_handle: 0x00000007
1 1 0

WriteConsoleW

 buffer: %XWnuCwLESxdOP% 30
console_handle: 0x00000007
1 1 0

WriteConsoleW

 buffer: C:\Users\test22\AppData\Local\Temp\IXP000.TMP>
console_handle: 0x00000007
1 1 0

WriteConsoleW

 buffer: C:\Users\test22\AppData\Local\Temp\IXP000.TMP>
console_handle: 0x00000007
1 1 0

WriteConsoleA

 buffer: Pinging test22-PC [fe80::4cc:7185:d814:e56e%11]
console_handle: 0x00000007
1 1 0

WriteConsoleA

 buffer: with 32 bytes of data:
console_handle: 0x00000007
1 1 0

WriteConsoleA

 buffer: Reply from fe80::4cc:7185:d814:e56e%11:
console_handle: 0x00000007
1 1 0

WriteConsoleA

 buffer: time<1ms
console_handle: 0x00000007
1 1 0

WriteConsoleA

 buffer: Reply from fe80::4cc:7185:d814:e56e%11:
console_handle: 0x00000007
1 1 0

WriteConsoleA

 buffer: time<1ms
console_handle: 0x00000007
1 1 0

WriteConsoleA

 buffer: Reply from fe80::4cc:7185:d814:e56e%11:
console_handle: 0x00000007
1 1 0

WriteConsoleA

 buffer: time<1ms
console_handle: 0x00000007
1 1 0

WriteConsoleA

 buffer: Reply from fe80::4cc:7185:d814:e56e%11:
console_handle: 0x00000007
1 1 0

WriteConsoleA

 buffer: time<1ms
console_handle: 0x00000007
1 1 0

WriteConsoleA

 buffer: Reply from fe80::4cc:7185:d814:e56e%11:
console_handle: 0x00000007
1 1 0

WriteConsoleA

 buffer: time<1ms
console_handle: 0x00000007
1 1 0

WriteConsoleA

 buffer: Reply from fe80::4cc:7185:d814:e56e%11:
console_handle: 0x00000007
1 1 0

WriteConsoleA

 buffer: time<1ms
console_handle: 0x00000007
1 1 0

WriteConsoleA

 buffer: Reply from fe80::4cc:7185:d814:e56e%11:
console_handle: 0x00000007
1 1 0

WriteConsoleA

 buffer: time<1ms
console_handle: 0x00000007
1 1 0

WriteConsoleA

 buffer: Reply from fe80::4cc:7185:d814:e56e%11:
console_handle: 0x00000007
1 1 0

WriteConsoleA

 buffer: time<1ms
console_handle: 0x00000007
1 1 0

WriteConsoleA

 buffer: Reply from fe80::4cc:7185:d814:e56e%11:
console_handle: 0x00000007
1 1 0

WriteConsoleA

 buffer: time<1ms
console_handle: 0x00000007
1 1 0

WriteConsoleA

 buffer: Reply from fe80::4cc:7185:d814:e56e%11:
console_handle: 0x00000007
1 1 0

WriteConsoleA

 buffer: time<1ms
console_handle: 0x00000007
1 1 0

WriteConsoleA

 buffer: Reply from fe80::4cc:7185:d814:e56e%11:
console_handle: 0x00000007
1 1 0

WriteConsoleA

 buffer: time<1ms
console_handle: 0x00000007
1 1 0

WriteConsoleA

 buffer: Reply from fe80::4cc:7185:d814:e56e%11:
console_handle: 0x00000007
1 1 0
Time & API Arguments Status Return Repeated

GlobalMemoryStatusEx

 1 1 0
section .ndata
Time & API Arguments Status Return Repeated

NtProtectVirtualMemory

 process_identifier: 2364
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x74231000
process_handle: 0xffffffff
1 0 0

NtProtectVirtualMemory

 process_identifier: 2364
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x74e51000
process_handle: 0xffffffff
1 0 0

NtProtectVirtualMemory

 process_identifier: 2364
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x10001000
process_handle: 0xffffffff
1 0 0

NtProtectVirtualMemory

 process_identifier: 2364
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x74221000
process_handle: 0xffffffff
1 0 0

NtProtectVirtualMemory

 process_identifier: 2364
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x73771000
process_handle: 0xffffffff
1 0 0

NtProtectVirtualMemory

 process_identifier: 2364
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x73cd4000
process_handle: 0xffffffff
1 0 0

NtProtectVirtualMemory

 process_identifier: 2364
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x73772000
process_handle: 0xffffffff
1 0 0

NtProtectVirtualMemory

 process_identifier: 668
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x74261000
process_handle: 0xffffffff
1 0 0

NtProtectVirtualMemory

 process_identifier: 668
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x73d61000
process_handle: 0xffffffff
1 0 0

NtProtectVirtualMemory

 process_identifier: 668
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x73d24000
process_handle: 0xffffffff
1 0 0

NtProtectVirtualMemory

 process_identifier: 668
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x73d62000
process_handle: 0xffffffff
1 0 0

NtProtectVirtualMemory

 process_identifier: 668
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x74231000
process_handle: 0xffffffff
1 0 0

NtProtectVirtualMemory

 process_identifier: 2704
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
length: 90112
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x02e03000
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2704
region_size: 155648
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x02cc0000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtProtectVirtualMemory

 process_identifier: 1744
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x73d61000
process_handle: 0xffffffff
1 0 0

NtProtectVirtualMemory

 process_identifier: 1744
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x73d24000
process_handle: 0xffffffff
1 0 0

NtProtectVirtualMemory

 process_identifier: 1744
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x73d62000
process_handle: 0xffffffff
1 0 0

NtProtectVirtualMemory

 process_identifier: 1748
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x73d61000
process_handle: 0xffffffff
1 0 0

NtProtectVirtualMemory

 process_identifier: 1748
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x73d24000
process_handle: 0xffffffff
1 0 0

NtProtectVirtualMemory

 process_identifier: 1748
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x73d62000
process_handle: 0xffffffff
1 0 0

NtProtectVirtualMemory

 process_identifier: 1444
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x73d61000
process_handle: 0xffffffff
1 0 0

NtProtectVirtualMemory

 process_identifier: 1444
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x73d24000
process_handle: 0xffffffff
1 0 0

NtProtectVirtualMemory

 process_identifier: 1444
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x73d62000
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 1444
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x00380000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtProtectVirtualMemory

 process_identifier: 1444
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
length: 102400
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x03f11000
process_handle: 0xffffffff
1 0 0

NtProtectVirtualMemory

 process_identifier: 1444
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
length: 32768
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x03f2a000
process_handle: 0xffffffff
1 0 0

NtProtectVirtualMemory

 process_identifier: 1444
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
length: 8192
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x03f32000
process_handle: 0xffffffff
1 0 0

NtProtectVirtualMemory

 process_identifier: 1444
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x03f34000
process_handle: 0xffffffff
1 0 0

NtProtectVirtualMemory

 process_identifier: 1444
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
length: 8192
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x03f35000
process_handle: 0xffffffff
1 0 0
Time & API Arguments Status Return Repeated

GetDiskFreeSpaceW

 number_of_free_clusters: 3350893
sectors_per_cluster: 8
bytes_per_sector: 512
root_path: \
total_number_of_clusters: 8362495
1 1 0

GetDiskFreeSpaceW

 number_of_free_clusters: 3350893
sectors_per_cluster: 8
bytes_per_sector: 512
root_path: \
total_number_of_clusters: 8362495
1 1 0
file C:\Program Files (x86)\foler\olader\acppage.dll
file C:\Users\test22\AppData\Local\Temp\IXP000.TMP\Tutte.exe.com
file C:\Program Files (x86)\foler\olader\acledit.dll
file C:\Users\test22\AppData\Local\Temp\nse3E75.tmp\UAC.dll
file C:\Program Files (x86)\foler\olader\adprovider.dll
file C:\Users\test22\AppData\Local\Temp\oflete\frat.exe
file C:\Users\test22\AppData\Local\Temp\oflete\afra.exe
file C:\Users\test22\AppData\Local\Temp\nse3E75.tmp\UAC.dll
file C:\Users\test22\AppData\Local\Temp\oflete\afra.exe
file C:\Users\test22\AppData\Local\Temp\oflete\frat.exe
url http://www.microsoft.com/schemas/ie8tldlistdescription/1.0
url http://purl.org/rss/1.0/
url http://www.passport.com
description Communication using DGA rule Network_DGA
description Communications use DNS rule Network_DNS
description Communications over RAW Socket rule Network_TCP_Socket
description Create a windows service rule Create_Service
description Record Audio rule Sniff_Audio
description Escalate priviledges rule Escalate_priviledges
description Run a KeyLogger rule KeyLogger
description Code injection with CreateRemoteThread in a remote process rule Code_injection
description Communications over HTTP rule Network_HTTP
description Hijack network configuration rule Hijack_Network
description Match Windows Inet API call rule Str_Win32_Internet_API
description Communications over FTP rule Network_FTP
description Take ScreenShot rule ScreenShot
description Match Windows Http API call rule Str_Win32_Http_API
description Steal credential rule local_credential_Steal
description File Downloader rule Network_Downloader
description Communications over P2P network rule Network_P2P_Win
description (no description) rule DebuggerCheck__GlobalFlags
description (no description) rule DebuggerCheck__QueryInfo
description (no description) rule DebuggerCheck__RemoteAPI
description (no description) rule DebuggerHiding__Thread
description (no description) rule DebuggerHiding__Active
description (no description) rule DebuggerException__ConsoleCtrl
description (no description) rule DebuggerException__SetConsoleCtrl
description (no description) rule ThreadControl__Context
description (no description) rule SEH__vectored
description (no description) rule Check_Dlls
description Checks if being debugged rule anti_dbg
description Anti-Sandbox checks for ThreatExpert rule antisb_threatExpert
description Bypass DEP rule disable_dep
description Affect hook table rule win_hook
description Install itself for autorun at Windows startup rule Persistence
cmdline "C:\Users\test22\AppData\Local\Temp\oflete\frat.exe"
cmdline ping TEST22-PC -n 30
file C:\ProgramData\AVAST Software
file C:\ProgramData\AVG
reg_key HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 reg_value rundll32.exe C:\Windows\system32\advpack.dll,DelNodeRunDLL32 "C:\Users\test22\AppData\Local\Temp\IXP000.TMP\"
Process injection Process 2692 resumed a thread in remote process 1744
Time & API Arguments Status Return Repeated

NtResumeThread

 thread_handle: 0x00000134
suspend_count: 0
process_identifier: 1744
1 0 0
Elastic malicious (high confidence)
MicroWorld-eScan Gen:Variant.Fragtor.9685
ALYac Gen:Variant.Fragtor.9685
Cylance Unsafe
Sangfor Trojan.Win32.Save.a
Alibaba Backdoor:Win32/Coins.837a0499
Arcabit Trojan.Fragtor.D25D5
Cyren W32/Kryptik.EWJ.gen!Eldorado
Symantec ML.Attribute.HighConfidence
ESET-NOD32 multiple detections
APEX Malicious
Paloalto generic.ml
ClamAV Win.Malware.Agen-9836298-0
Kaspersky Backdoor.Win32.Agent.myuddl
BitDefender Gen:Variant.Fragtor.9685
Avast Win32:DropperX-gen [Drp]
Rising Trojan.Kryptik!1.D8AC (CLASSIC)
Sophos Mal/Generic-S
McAfee-GW-Edition BehavesLike.Win32.GenDownloader.tc
FireEye Gen:Variant.Fragtor.9685
Emsisoft Trojan.Crypt (A)
Webroot W32.Malware.Gen
Kingsoft Win32.Hack.Undef.(kcloud)
Gridinsoft Trojan.Win32.Agent.oa
Microsoft Trojan:Win32/Sabsik.FL.A!ml
ZoneAlarm Backdoor.Win32.Agent.myuddl
GData Win32.Trojan.BSE.HLJWVB
Cynet Malicious (score: 100)
AhnLab-V3 Dropper/Win.Generic.C4599565
McAfee Artemis!CCFC289366F0
MAX malware (ai score=82)
VBA32 BScope.Trojan.Glupteba
Malwarebytes Malware.AI.1294164741
TrendMicro-HouseCall TROJ_GEN.R002H0CHK21
Tencent Win32.Backdoor.Agent.Tdps
Ikarus Malware.Win32.AVEvader
eGambit Unsafe.AI_Score_99%
BitDefenderTheta Gen:NN.ZexaF.34088.mq0@a0Ms4Chi
AVG Win32:DropperX-gen [Drp]
Panda Trj/CI.A