Favorites
Tools
Dr.Zero Chatbot
Notifications
Guide 2020-06-10
Version history 2020-06-10

Summary | ZeroBOX

0bd168703d2bb6a6d5fffe115c4834f4057bcb7f7877369a3230a82badce3d15.msi

Emotet Gen1 Generic Malware Malicious Library Malicious Packer MSOffice File

Category	Machine	Started	Completed
FILE	s1_win7_x6401	Sept. 20, 2021, 9:01 p.m.	Sept. 20, 2021, 9:01 p.m.

Size	5.6MB
Type	Composite Document File V2 Document, Little Endian, Os: Windows, Version 10.0, MSI Installer, Title: Installation Database, Keywords: Installer, MSI, Database, Last Printed: Fri Dec 11 11:47:44 2009, Create Time/Date: Fri Dec 11 11:47:44 2009, Last Saved Time/Date: Fri Dec 11 11:47:44 2009, Number of Pages: 200, Security: 0, Code page: 1252, Revision Number: {B0BD1373-A823-4BAA-A2E5-923D584B59EB}, Number of Words: 10, Subject: windows erro memory management,,, Author: Windows installer windows erro memory management,,, Name of Creating Application: Advanced Installer 12.3 build 64631, Template: ;1046, Comments: windows erro memory management
MD5	`3eb2ea9527590196759a92fdd24eaf8b`
SHA256	`0bd168703d2bb6a6d5fffe115c4834f4057bcb7f7877369a3230a82badce3d15`
CRC32	`A1EEC4E1`
ssdeep	`98304:VY5A1bGRlQ3f53eyibmw8a0FDIhnuijpaLU4UUU3UUUtvFOvLU4UUU3UUUtvFO:hyQvReydwFkOnuijpaLU4UUU3UUUhFOy`
Yara	Malicious_Packer_Zero - Malicious Packer Generic_Malware_Zero - Generic Malware Win32_Trojan_Gen_2_0904B0_Zero - Win32 Trojan Gen Win32_Trojan_Emotet_2_Zero - Win32 Trojan Emotet Malicious_Library_Zero - Malicious_Library Microsoft_Office_File_Zero - Microsoft Office File Win32_Trojan_Gen_1_0904B0_Zero - Win32 Trojan Emotet

msiexec.exe "C:\Windows\System32\msiexec.exe" /I C:\Users\test22\AppData\Local\Temp\0bd168703d2bb6a6d5fffe115c4834f4057bcb7f7877369a3230a82badce3d15.msi
2232

Name	Response	Post-Analysis Lookup
bit.ly	A 67.199.248.11 A 67.199.248.10	67.199.248.10
lubagalord.duckdns.org

IP Address	Status	Action
164.124.101.2	Active	Moloch
67.199.248.10	Active	Moloch

Suricata Alerts

Flow	SID	Signature	Category
TCP 192.168.56.101:49199 -> 67.199.248.10:443	906200056	SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee)	undefined
TCP 192.168.56.101:49200 -> 67.199.248.10:443	906200056	SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee)	undefined
TCP 192.168.56.101:49202 -> 67.199.248.10:443	906200056	SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee)	undefined
UDP 192.168.56.101:59369 -> 164.124.101.2:53	2022918	ET INFO DYNAMIC_DNS Query to *.duckdns. Domain	Misc activity
TCP 192.168.56.101:49205 -> 67.199.248.10:443	906200056	SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee)	undefined
TCP 192.168.56.101:49203 -> 67.199.248.10:443	906200056	SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee)	undefined

Suricata TLS

No Suricata TLS

Queries for the computername (3 events)

Time & API	Arguments	Status	Return	Repeated
GetComputerNameW Sept. 20, 2021, 9:01 p.m.	computer_name: TEST22-PC	1	1	0
GetComputerNameA Sept. 20, 2021, 9:01 p.m.	computer_name: TEST22-PC	1	1	0
GetComputerNameW Sept. 20, 2021, 9:01 p.m.	computer_name: TEST22-PC	1	1	0

Checks if process is being debugged by a debugger (1 event)

Time & API	Arguments	Status	Return	Repeated
IsDebuggerPresent Sept. 20, 2021, 9:01 p.m.			0	0

Checks amount of memory in system, this can be used to detect virtual machines that have a low amount of memory available (1 event)

Time & API	Arguments	Status	Return	Repeated
GlobalMemoryStatusEx Sept. 20, 2021, 9:01 p.m.		1	1	0

Connects to a Dynamic DNS Domain (1 event)

domain

lubagalord.duckdns.org

Allocates read-write-execute memory (usually to unpack itself) (15 events)

Time & API	Arguments	Status	Return	Repeated
NtProtectVirtualMemory Sept. 20, 2021, 9:01 p.m.	process_identifier: 2232 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x725d1000 process_handle: 0xffffffff	1	0	0
NtProtectVirtualMemory Sept. 20, 2021, 9:01 p.m.	process_identifier: 2232 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x73c71000 process_handle: 0xffffffff	1	0	0
NtProtectVirtualMemory Sept. 20, 2021, 9:01 p.m.	process_identifier: 2232 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x72561000 process_handle: 0xffffffff	1	0	0
NtProtectVirtualMemory Sept. 20, 2021, 9:01 p.m.	process_identifier: 2232 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x73764000 process_handle: 0xffffffff	1	0	0
NtProtectVirtualMemory Sept. 20, 2021, 9:01 p.m.	process_identifier: 2232 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x72562000 process_handle: 0xffffffff	1	0	0
NtProtectVirtualMemory Sept. 20, 2021, 9:01 p.m.	process_identifier: 2232 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x72221000 process_handle: 0xffffffff	1	0	0
NtProtectVirtualMemory Sept. 20, 2021, 9:01 p.m.	process_identifier: 2232 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x736e1000 process_handle: 0xffffffff	1	0	0
NtProtectVirtualMemory Sept. 20, 2021, 9:01 p.m.	process_identifier: 2232 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x732d1000 process_handle: 0xffffffff	1	0	0
NtProtectVirtualMemory Sept. 20, 2021, 9:01 p.m.	process_identifier: 2232 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x72201000 process_handle: 0xffffffff	1	0	0
NtProtectVirtualMemory Sept. 20, 2021, 9:01 p.m.	process_identifier: 2232 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x721a1000 process_handle: 0xffffffff	1	0	0
NtAllocateVirtualMemory Sept. 20, 2021, 9:01 p.m.	process_identifier: 2232 region_size: 655360 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x041e0000 allocation_type: 8192 (MEM_RESERVE) process_handle: 0xffffffff	1	0	0
NtAllocateVirtualMemory Sept. 20, 2021, 9:01 p.m.	process_identifier: 2232 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x04240000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1	0	0
NtProtectVirtualMemory Sept. 20, 2021, 9:01 p.m.	process_identifier: 2232 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x72192000 process_handle: 0xffffffff	1	0	0
NtAllocateVirtualMemory Sept. 20, 2021, 9:01 p.m.	process_identifier: 2232 region_size: 655360 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x043b0000 allocation_type: 8192 (MEM_RESERVE) process_handle: 0xffffffff	1	0	0
NtAllocateVirtualMemory Sept. 20, 2021, 9:01 p.m.	process_identifier: 2232 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x04410000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1	0	0

Queries the disk size which could be used to detect virtual machine with small fixed size or dynamic allocation (2 events)

Time & API	Arguments	Status	Return	Repeated
GetDiskFreeSpaceExW Sept. 20, 2021, 9:01 p.m.	total_number_of_free_bytes: 13722841088 free_bytes_available: 13722841088 root_path: C:\ total_number_of_bytes: 34252779520	1	1	0
GetDiskFreeSpaceW Sept. 20, 2021, 9:01 p.m.	number_of_free_clusters: 3350303 sectors_per_cluster: 8 bytes_per_sector: 512 root_path: C:\ total_number_of_clusters: 8362495	1	1	0

Checks for the Locally Unique Identifier on the system for a suspicious privilege (16 events)

Time & API	Arguments	Status	Return	Repeated
LookupPrivilegeValueW Sept. 20, 2021, 9:01 p.m.	system_name: privilege_name: SeShutdownPrivilege	1	1	0
LookupPrivilegeValueW Sept. 20, 2021, 9:01 p.m.	system_name: privilege_name: SeCreateTokenPrivilege	1	1	0
LookupPrivilegeValueW Sept. 20, 2021, 9:01 p.m.	system_name: privilege_name: SeAssignPrimaryTokenPrivilege	1	1	0
LookupPrivilegeValueW Sept. 20, 2021, 9:01 p.m.	system_name: privilege_name: SeMachineAccountPrivilege	1	1	0
LookupPrivilegeValueW Sept. 20, 2021, 9:01 p.m.	system_name: privilege_name: SeTcbPrivilege	1	1	0
LookupPrivilegeValueW Sept. 20, 2021, 9:01 p.m.	system_name: privilege_name: SeSecurityPrivilege	1	1	0
LookupPrivilegeValueW Sept. 20, 2021, 9:01 p.m.	system_name: privilege_name: SeTakeOwnershipPrivilege	1	1	0
LookupPrivilegeValueW Sept. 20, 2021, 9:01 p.m.	system_name: privilege_name: SeLoadDriverPrivilege	1	1	0
LookupPrivilegeValueW Sept. 20, 2021, 9:01 p.m.	system_name: privilege_name: SeBackupPrivilege	1	1	0
LookupPrivilegeValueW Sept. 20, 2021, 9:01 p.m.	system_name: privilege_name: SeRestorePrivilege	1	1	0
LookupPrivilegeValueW Sept. 20, 2021, 9:01 p.m.	system_name: privilege_name: SeShutdownPrivilege	1	1	0
LookupPrivilegeValueW Sept. 20, 2021, 9:01 p.m.	system_name: privilege_name: SeDebugPrivilege	1	1	0
LookupPrivilegeValueW Sept. 20, 2021, 9:01 p.m.	system_name: privilege_name: SeRemoteShutdownPrivilege	1	1	0
LookupPrivilegeValueW Sept. 20, 2021, 9:01 p.m.	system_name: privilege_name: SeEnableDelegationPrivilege	1	1	0
LookupPrivilegeValueW Sept. 20, 2021, 9:01 p.m.	system_name: privilege_name: SeManageVolumePrivilege	1	1	0
LookupPrivilegeValueW Sept. 20, 2021, 9:01 p.m.	system_name: privilege_name: SeCreateGlobalPrivilege	1	1	0

File has been identified by 18 AntiVirus engines on VirusTotal as malicious (18 events)

Arcabit	Trojan.Generic.D2C812EE
Symantec	ISB.Downloader!gen60
ESET-NOD32	JS/TrojanDownloader.Agent.TVP
Avast	Other:Malware-gen [Trj]
Kaspersky	HEUR:Trojan-Downloader.Script.SLoad.gen
BitDefender	Trojan.GenericKD.46666478
MicroWorld-eScan	Trojan.GenericKD.46666478
Ad-Aware	Trojan.GenericKD.46666478
Emsisoft	Trojan.GenericKD.46666478 (B)
McAfee-GW-Edition	Artemis!Trojan
FireEye	Trojan.GenericKD.46666478
Avira	JS/Dldr.Agent.usimt
ZoneAlarm	HEUR:Trojan-Downloader.Script.SLoad.gen
GData	Trojan.GenericKD.46666478
ALYac	Trojan.JS.Agent.UEF
MAX	malware (ai score=89)
Fortinet	JS/Agent.UEF!tr
AVG	Other:Malware-gen [Trj]