popup
Summary | ZeroBOX
  1. Home
  2. Result
  3. Report
  4. Detail Analysis

lv.exe

Emotet Gen1 Generic Malware Malicious Library UPX Malicious Packer PE File PE32 DLL
  1. Resubmit sample
Category Machine Started Completed
FILE s1_win7_x6402 Aug. 29, 2021, 12:35 p.m. Aug. 29, 2021, 12:40 p.m.
Size 1.2MB
Type PE32 executable (GUI) Intel 80386, for MS Windows
MD5 199172dc2093263eed50e3f744859def
SHA256 c8ceceea071185485187862365097bbb02345c6519788db06c76d2286bec4efc
CRC32 CA2ADB9A
ssdeep 24576:kijmOmv1ZSO0PgnloOKVEdKlfMeezNEfRmoIXLRn10GEDbsla5I:3qbv1ZRnlA2dKi9h5bwG7MI
Yara
  • PE_Header_Zero - PE File Signature
  • Malicious_Library_Zero - Malicious_Library
  • IsPE32 - (no description)

Name Response Post-Analysis Lookup
sLmenmIQFwSvOylTBAq.sLmenmIQFwSvOylTBAq
IP Address Status Action
164.124.101.2 Active Moloch

Suricata Alerts

No Suricata Alerts

Suricata TLS

No Suricata TLS

Time & API Arguments Status Return Repeated

IsDebuggerPresent

 0 0

IsDebuggerPresent

 0 0

IsDebuggerPresent

 0 0
Time & API Arguments Status Return Repeated

WriteConsoleW

 buffer: Microsoft Windows [Version 6.1.7601]
console_handle: 0x00000007
1 1 0

WriteConsoleW

 buffer: Copyright (c) 2009 Microsoft Corporation. All rights reserved.
console_handle: 0x00000007
1 1 0

WriteConsoleW

 buffer: C:\Users\test22\AppData\Local\Temp\IXP000.TMP>
console_handle: 0x00000007
1 1 0

WriteConsoleW

 buffer: Set XeHqQBPEmeFSERcVEOyHV=DESKTOP-
console_handle: 0x00000007
1 1 0

WriteConsoleW

 buffer: C:\Users\test22\AppData\Local\Temp\IXP000.TMP>
console_handle: 0x00000007
1 1 0

WriteConsoleW

 buffer: Set JwNyOnqOHmbaoGTQwAevsTiEl=QO5QU33
console_handle: 0x00000007
1 1 0

WriteConsoleW

 buffer: C:\Users\test22\AppData\Local\Temp\IXP000.TMP>
console_handle: 0x00000007
1 1 0

WriteConsoleW

 buffer: Set uKxztyDNrQmeU=ping %computername% -n
console_handle: 0x00000007
1 1 0

WriteConsoleW

 buffer: C:\Users\test22\AppData\Local\Temp\IXP000.TMP>
console_handle: 0x00000007
1 1 0

WriteConsoleW

 buffer: if %computername%==%XeHqQBPEmeFSERcVEOyHV% %uKxztyDNrQmeU% 300
console_handle: 0x00000007
1 1 0

WriteConsoleW

 buffer: C:\Users\test22\AppData\Local\Temp\IXP000.TMP>
console_handle: 0x00000007
1 1 0

WriteConsoleW

 buffer: Set LbMUxFVBJzNuRBPlRQWxlhpmNeRlulZIn=MZ
console_handle: 0x00000007
1 1 0

WriteConsoleW

 buffer: C:\Users\test22\AppData\Local\Temp\IXP000.TMP>
console_handle: 0x00000007
1 1 0

WriteConsoleW

 buffer: <nul set /p = "%LbMUxFVBJzNuRBPlRQWxlhpmNeRlulZIn%" > Sostenere.exe.com
console_handle: 0x00000007
1 1 0

WriteConsoleW

 buffer: C:\Users\test22\AppData\Local\Temp\IXP000.TMP>
console_handle: 0x00000007
1 1 0

WriteConsoleW

 buffer: findstr /V /R "^toPTNDAGrwdfFxFiKkVwGngjiaNLxmxtHJbGcXeaTDpipbvbEZmOMvBGTCMxPPkEHkHWWYMNoDiegirJWducZGakiRN$" Meno.png >> Sostenere.exe.com"
console_handle: 0x00000007
1 1 0

WriteConsoleW

 buffer: C:\Users\test22\AppData\Local\Temp\IXP000.TMP>
console_handle: 0x00000007
1 1 0

WriteConsoleW

 buffer: copy Afa.png G
console_handle: 0x00000007
1 1 0

WriteConsoleW

 buffer: 1 file(s) copied.
console_handle: 0x00000007
1 1 0

WriteConsoleW

 buffer: C:\Users\test22\AppData\Local\Temp\IXP000.TMP>
console_handle: 0x00000007
1 1 0

WriteConsoleW

 buffer: start Sostenere.exe.com G
console_handle: 0x00000007
1 1 0

WriteConsoleW

 buffer: C:\Users\test22\AppData\Local\Temp\IXP000.TMP>
console_handle: 0x00000007
1 1 0

WriteConsoleW

 buffer: %uKxztyDNrQmeU% 30
console_handle: 0x00000007
1 1 0

WriteConsoleW

 buffer: C:\Users\test22\AppData\Local\Temp\IXP000.TMP>
console_handle: 0x00000007
1 1 0

WriteConsoleW

 buffer: C:\Users\test22\AppData\Local\Temp\IXP000.TMP>
console_handle: 0x00000007
1 1 0

WriteConsoleA

 buffer: Pinging test22-PC [fe80::4cc:7185:d814:e56e%11]
console_handle: 0x00000007
1 1 0

WriteConsoleA

 buffer: with 32 bytes of data:
console_handle: 0x00000007
1 1 0

WriteConsoleA

 buffer: Reply from fe80::4cc:7185:d814:e56e%11:
console_handle: 0x00000007
1 1 0

WriteConsoleA

 buffer: time<1ms
console_handle: 0x00000007
1 1 0

WriteConsoleA

 buffer: Reply from fe80::4cc:7185:d814:e56e%11:
console_handle: 0x00000007
1 1 0

WriteConsoleA

 buffer: time<1ms
console_handle: 0x00000007
1 1 0

WriteConsoleA

 buffer: Reply from fe80::4cc:7185:d814:e56e%11:
console_handle: 0x00000007
1 1 0

WriteConsoleA

 buffer: time<1ms
console_handle: 0x00000007
1 1 0

WriteConsoleA

 buffer: Reply from fe80::4cc:7185:d814:e56e%11:
console_handle: 0x00000007
1 1 0

WriteConsoleA

 buffer: time<1ms
console_handle: 0x00000007
1 1 0

WriteConsoleA

 buffer: Reply from fe80::4cc:7185:d814:e56e%11:
console_handle: 0x00000007
1 1 0

WriteConsoleA

 buffer: time<1ms
console_handle: 0x00000007
1 1 0

WriteConsoleA

 buffer: Reply from fe80::4cc:7185:d814:e56e%11:
console_handle: 0x00000007
1 1 0

WriteConsoleA

 buffer: time<1ms
console_handle: 0x00000007
1 1 0

WriteConsoleA

 buffer: Reply from fe80::4cc:7185:d814:e56e%11:
console_handle: 0x00000007
1 1 0

WriteConsoleA

 buffer: time<1ms
console_handle: 0x00000007
1 1 0

WriteConsoleA

 buffer: Reply from fe80::4cc:7185:d814:e56e%11:
console_handle: 0x00000007
1 1 0

WriteConsoleA

 buffer: time<1ms
console_handle: 0x00000007
1 1 0

WriteConsoleA

 buffer: Reply from fe80::4cc:7185:d814:e56e%11:
console_handle: 0x00000007
1 1 0

WriteConsoleA

 buffer: time<1ms
console_handle: 0x00000007
1 1 0

WriteConsoleA

 buffer: Reply from fe80::4cc:7185:d814:e56e%11:
console_handle: 0x00000007
1 1 0

WriteConsoleA

 buffer: time<1ms
console_handle: 0x00000007
1 1 0

WriteConsoleA

 buffer: Reply from fe80::4cc:7185:d814:e56e%11:
console_handle: 0x00000007
1 1 0

WriteConsoleA

 buffer: time<1ms
console_handle: 0x00000007
1 1 0

WriteConsoleA

 buffer: Reply from fe80::4cc:7185:d814:e56e%11:
console_handle: 0x00000007
1 1 0
Time & API Arguments Status Return Repeated

GlobalMemoryStatusEx

 1 1 0
section .ndata
Time & API Arguments Status Return Repeated

NtProtectVirtualMemory

 process_identifier: 1760
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x73fd1000
process_handle: 0xffffffff
1 0 0

NtProtectVirtualMemory

 process_identifier: 1760
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x76ec1000
process_handle: 0xffffffff
1 0 0

NtProtectVirtualMemory

 process_identifier: 1760
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x10001000
process_handle: 0xffffffff
1 0 0

NtProtectVirtualMemory

 process_identifier: 1760
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x73fc1000
process_handle: 0xffffffff
1 0 0

NtProtectVirtualMemory

 process_identifier: 1760
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x73e91000
process_handle: 0xffffffff
1 0 0

NtProtectVirtualMemory

 process_identifier: 1760
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x732b1000
process_handle: 0xffffffff
1 0 0

NtProtectVirtualMemory

 process_identifier: 1760
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x73e92000
process_handle: 0xffffffff
1 0 0

NtProtectVirtualMemory

 process_identifier: 1944
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x74101000
process_handle: 0xffffffff
1 0 0

NtProtectVirtualMemory

 process_identifier: 1944
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x74021000
process_handle: 0xffffffff
1 0 0

NtProtectVirtualMemory

 process_identifier: 1944
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x73ef1000
process_handle: 0xffffffff
1 0 0

NtProtectVirtualMemory

 process_identifier: 1944
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x74022000
process_handle: 0xffffffff
1 0 0

NtProtectVirtualMemory

 process_identifier: 1944
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x740a1000
process_handle: 0xffffffff
1 0 0

NtProtectVirtualMemory

 process_identifier: 1944
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x740a3000
process_handle: 0xffffffff
1 0 0

NtProtectVirtualMemory

 process_identifier: 1944
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x73ff1000
process_handle: 0xffffffff
1 0 0

NtProtectVirtualMemory

 process_identifier: 896
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
length: 90112
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x02d92000
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 896
region_size: 155648
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x02cd0000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtProtectVirtualMemory

 process_identifier: 2332
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x74021000
process_handle: 0xffffffff
1 0 0

NtProtectVirtualMemory

 process_identifier: 2332
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x73ef1000
process_handle: 0xffffffff
1 0 0

NtProtectVirtualMemory

 process_identifier: 2332
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x74022000
process_handle: 0xffffffff
1 0 0

NtProtectVirtualMemory

 process_identifier: 2760
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x74021000
process_handle: 0xffffffff
1 0 0

NtProtectVirtualMemory

 process_identifier: 2760
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x73ef1000
process_handle: 0xffffffff
1 0 0

NtProtectVirtualMemory

 process_identifier: 2760
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x74022000
process_handle: 0xffffffff
1 0 0

NtProtectVirtualMemory

 process_identifier: 2760
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
length: 102400
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x044b1000
process_handle: 0xffffffff
1 0 0

NtProtectVirtualMemory

 process_identifier: 2760
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
length: 32768
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x044ca000
process_handle: 0xffffffff
1 0 0

NtProtectVirtualMemory

 process_identifier: 2760
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
length: 8192
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x044d2000
process_handle: 0xffffffff
1 0 0

NtProtectVirtualMemory

 process_identifier: 2760
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x044d4000
process_handle: 0xffffffff
1 0 0

NtProtectVirtualMemory

 process_identifier: 2760
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
length: 8192
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x044d5000
process_handle: 0xffffffff
1 0 0
Time & API Arguments Status Return Repeated

GetDiskFreeSpaceW

 number_of_free_clusters: 2668398
sectors_per_cluster: 8
bytes_per_sector: 512
root_path: \
total_number_of_clusters: 8362495
1 1 0

GetDiskFreeSpaceW

 number_of_free_clusters: 2668398
sectors_per_cluster: 8
bytes_per_sector: 512
root_path: \
total_number_of_clusters: 8362495
1 1 0
file C:\Users\test22\AppData\Local\Temp\nsz78C4.tmp\UAC.dll
file C:\Users\test22\AppData\Local\Temp\IXP000.TMP\Sostenere.exe.com
file C:\Program Files (x86)\foler\olader\acppage.dll
file C:\Program Files (x86)\foler\olader\acledit.dll
file C:\Users\test22\AppData\Local\Temp\ventil\ptrv.exe
file C:\Program Files (x86)\foler\olader\adprovider.dll
file C:\Users\test22\AppData\Local\Temp\ventil\faer.exe
file C:\Users\test22\AppData\Local\Temp\nsz78C4.tmp\UAC.dll
file C:\Users\test22\AppData\Local\Temp\ventil\ptrv.exe
file C:\Users\test22\AppData\Local\Temp\ventil\faer.exe
section {u'size_of_data': u'0x00011a00', u'virtual_address': u'0x00160000', u'entropy': 7.32019225414287, u'name': u'.rsrc', u'virtual_size': u'0x00011850'} entropy 7.32019225414 description A section with a high entropy has been found
section {u'size_of_data': u'0x00001000', u'virtual_address': u'0x00172000', u'entropy': 7.920210947259952, u'name': u'.reloc', u'virtual_size': u'0x00000fd6'} entropy 7.92021094726 description A section with a high entropy has been found
entropy 0.647826086957 description Overall entropy of this PE file is high
cmdline ping TEST22-PC -n 30
file C:\ProgramData\AVAST Software
file C:\ProgramData\AVG
reg_key HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 reg_value rundll32.exe C:\Windows\system32\advpack.dll,DelNodeRunDLL32 "C:\Users\test22\AppData\Local\Temp\IXP000.TMP\"
Process injection Process 2272 resumed a thread in remote process 2332
Time & API Arguments Status Return Repeated

NtResumeThread

 thread_handle: 0x00000134
suspend_count: 0
process_identifier: 2332
1 0 0
Elastic malicious (high confidence)
MicroWorld-eScan Dropped:Trojan.GenericKD.37486338
CAT-QuickHeal Trojanpws.Coins
Cylance Unsafe
Sangfor Trojan.Win32.Save.a
Alibaba Backdoor:Win32/Coins.5f2edcae
K7GW Riskware ( 0040eff71 )
K7AntiVirus Riskware ( 0040eff71 )
Cyren W32/Kryptik.EWJ.gen!Eldorado
Symantec ML.Attribute.HighConfidence
ESET-NOD32 multiple detections
APEX Malicious
Paloalto generic.ml
ClamAV Win.Packed.Filerepmalware-9864117-0
Kaspersky Backdoor.Win32.Agent.myudhg
BitDefender Dropped:Trojan.GenericKD.37486338
Avast NSIS:MalwareX-gen [Trj]
Rising Trojan.Kryptik!1.D8AC (CLASSIC)
Ad-Aware Dropped:Trojan.GenericKD.37486338
DrWeb Trojan.MulDrop18.36307
McAfee-GW-Edition BehavesLike.Win32.Dropper.tc
FireEye Dropped:Trojan.GenericKD.37486338
Emsisoft Trojan.Crypt (A)
GData Win32.Trojan.BSE.HLJWVB
Webroot W32.Malware.Gen
Kingsoft Win32.Hack.Undef.(kcloud)
Microsoft Trojan:Win32/Sabsik.FL.B!ml
Cynet Malicious (score: 100)
AhnLab-V3 Infostealer/Win.CryptBot.R438883
McAfee Artemis!199172DC2093
MAX malware (ai score=84)
VBA32 BScope.TrojanRansom.Blocker
Malwarebytes Trojan.BitCoinStealer
Tencent Win32.Trojan-qqpass.Qqrob.Dztx
eGambit Unsafe.AI_Score_75%
Fortinet W32/multiple_detections
BitDefenderTheta Gen:NN.ZexaF.34110.oq0@a8qUccoG
AVG NSIS:MalwareX-gen [Trj]
Panda Trj/Agent.ALS