Summary | ZeroBOX

Category	Machine	Started	Completed
FILE	s1_win7_x6401	Sept. 25, 2021, 10:55 a.m.	Sept. 25, 2021, 11:01 a.m.

Size	345.5KB
Type	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
MD5	`e7ac180e8217a97505fee5b06709d331`
SHA256	`d5fe3f6846ca1f5e09e94d66a816c3fc00634013ca7bf9e35361bd185a27c395`
CRC32	`F786CBA5`
ssdeep	`6144:8ufHKG+wtMydWttXtUxIhYD+BHi1RN5CA9fc0C5Na5uMt/bL22P:JqG+aMydWXX6Jqi1RJVcfN4pRLhP`
PDB Path	c:\885\Thus\Drop\Occur\159_take\King.pdb
Yara	PE_Header_Zero - PE File Signature OS_Processor_Check_Zero - OS Processor Check IsDLL - (no description) Malicious_Library_Zero - Malicious_Library IsPE32 - (no description)

rundll32.exe "C:\Windows\System32\rundll32.exe" C:\Users\test22\AppData\Local\Temp\a435gfhs109.cms.dll,WICConvertBitmapSource
2088
rundll32.exe "C:\Windows\System32\rundll32.exe" C:\Users\test22\AppData\Local\Temp\a435gfhs109.cms.dll,
2428

Name	Response	Post-Analysis Lookup
No hosts contacted.

IP Address	Status	Action
164.124.101.2	Active	Moloch

Suricata Alerts

No Suricata Alerts

Suricata TLS

No Suricata TLS

Queries for the computername (4 events)

Time & API	Arguments	Status	Return
GetComputerNameW Sept. 25, 2021, 10:56 a.m.	computer_name:		0
GetComputerNameW Sept. 25, 2021, 10:56 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameW Sept. 25, 2021, 10:56 a.m.	computer_name:		0
GetComputerNameW Sept. 25, 2021, 10:56 a.m.	computer_name: TEST22-PC	1	1

Collects information to fingerprint the system (MachineGuid, DigitalProductId, SystemBiosDate) (1 event)

registry

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\InstallDate

This executable has a PDB path (1 event)

pdb_path

c:\885\Thus\Drop\Occur\159_take\King.pdb

Allocates read-write-execute memory (usually to unpack itself) (9 events)

Time & API	Arguments	Status
NtProtectVirtualMemory Sept. 25, 2021, 10:55 a.m.	process_identifier: 2088 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x73d4e000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Sept. 25, 2021, 10:55 a.m.	process_identifier: 2088 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x73c91000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Sept. 25, 2021, 10:55 a.m.	process_identifier: 2088 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x73de1000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Sept. 25, 2021, 10:56 a.m.	process_identifier: 2088 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 24576 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x73d78000 process_handle: 0xffffffff	1
NtAllocateVirtualMemory Sept. 25, 2021, 10:56 a.m.	process_identifier: 2088 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x003a0000 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Sept. 25, 2021, 10:56 a.m.	process_identifier: 2088 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x003b0000 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Sept. 25, 2021, 10:56 a.m.	process_identifier: 2088 region_size: 151552 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x004c0000 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0xffffffff	1
NtProtectVirtualMemory Sept. 25, 2021, 10:56 a.m.	process_identifier: 2088 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x73701000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Sept. 25, 2021, 10:56 a.m.	process_identifier: 2088 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x72991000 process_handle: 0xffffffff	1

Looks for the Windows Idle Time to determine the uptime (1 event)

Time & API	Arguments	Status	Return	Repeated
NtQuerySystemInformation Sept. 25, 2021, 10:56 a.m.	information_class: 8 (SystemProcessorPerformanceInformation)	1	0	0

File has been identified by 22 AntiVirus engines on VirusTotal as malicious (22 events)

Elastic	malicious (high confidence)
MicroWorld-eScan	Trojan.GenericKD.37639334
McAfee	RDN/PWS-Banker
ESET-NOD32	a variant of Win32/GenKryptik.FLCI
Kaspersky	HEUR:Trojan-Banker.Win32.Cridex.gen
BitDefender	Trojan.GenericKD.37639334
Avast	Win32:Trojan-gen
Ad-Aware	Trojan.GenericKD.37639334
McAfee-GW-Edition	Artemis!Trojan
FireEye	Trojan.GenericKD.37639334
Emsisoft	Trojan.GenericKD.37639334 (B)
Ikarus	Trojan.Win32.Krypt
GData	Win32.Trojan-Spy.Ursnif.5L9XB9
Webroot	W32.Malware.Gen
Kingsoft	Win32.Troj.Banker.(kcloud)
ZoneAlarm	HEUR:Trojan-Banker.Win32.Cridex.gen
Microsoft	TrojanSpy:Win32/Vigorf.A
MAX	malware (ai score=85)
SentinelOne	Static AI - Malicious PE
Fortinet	W32/GenKryptik.FLCI!tr
BitDefenderTheta	Gen:NN.ZedlaF.34170.vq4@aCiNvJh
AVG	Win32:Trojan-gen

a435gfhs109.cms

Process Tree Toggle all

Network Toggle all

Suricata Toggle all

Suricata Alerts

Suricata TLS

Signatures Toggle All