popup
Summary | ZeroBOX
  1. Home
  2. Result
  3. Report
  4. Detail Analysis

%E5%88%9D%E5%A6%86%E5%8A%A9%E6%89%8B.exe

Emotet Generic Malware Malicious Library UPX Malicious Packer PE64 PE File OS Processor Check PE32
  1. Resubmit sample
Category Machine Started Completed
FILE s1_win7_x6402 Oct. 12, 2021, 9:54 a.m. Oct. 12, 2021, 10:15 a.m.
Size 1.6MB
Type PE32 executable (GUI) Intel 80386, for MS Windows
MD5 5019b4c4d5e6b67a826897bff52a0d23
SHA256 dae3bac63c41c7d794ec1b30a2199579477c6e4bdc506b22dbb522a55dd7dba9
CRC32 E686CFC3
ssdeep 24576:N4nXubIQGyxbPV0db26+Adbho+vogz2dbFFv0S6dS/01icZOEOR5QvH5:Nqe3f6m+DidXvh6dS/04OOR5QvH5
Yara
  • PE_Header_Zero - PE File Signature
  • IsPE32 - (no description)
  • OS_Processor_Check_Zero - OS Processor Check
  • Win32_Trojan_Emotet_2_Zero - Win32 Trojan Emotet
  • Malicious_Library_Zero - Malicious_Library

Name Response Post-Analysis Lookup
No hosts contacted.
IP Address Status Action
91.195.240.94 Active Moloch

Suricata Alerts

No Suricata Alerts

Suricata TLS

No Suricata TLS

Time & API Arguments Status Return Repeated

IsDebuggerPresent

 0 0
section .itext
section .didata
Time & API Arguments Status Return Repeated

NtProtectVirtualMemory

 process_identifier: 1052
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x00400000
process_handle: 0xffffffff
1 0 0

NtProtectVirtualMemory

 process_identifier: 1052
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 745472
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x00401000
process_handle: 0xffffffff
1 0 0

NtProtectVirtualMemory

 process_identifier: 1052
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x004c4000
process_handle: 0xffffffff
1 0 0

NtProtectVirtualMemory

 process_identifier: 1052
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 24576
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x004c6000
process_handle: 0xffffffff
1 0 0

NtProtectVirtualMemory

 process_identifier: 1052
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x73522000
process_handle: 0xffffffff
1 0 0

NtProtectVirtualMemory

 process_identifier: 2132
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x73522000
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2132
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x021b0000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0
file C:\Users\test22\AppData\Local\Temp\is-N0558.tmp\%E5%88%9D%E5%A6%86%E5%8A%A9%E6%89%8B.tmp
Time & API Arguments Status Return Repeated

RegOpenKeyExW

 regkey_r: Software\Microsoft\Windows\CurrentVersion\Uninstall\{C9CC97F1-09C2-444E-B0D2-6967AD62E6DB}_is1
base_handle: 0x80000001
key_handle: 0x00000000
options: 0
access: 0x00000001
regkey: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Uninstall\{C9CC97F1-09C2-444E-B0D2-6967AD62E6DB}_is1
2 0

RegOpenKeyExW

 regkey_r: Software\Microsoft\Windows\CurrentVersion\Uninstall\{C9CC97F1-09C2-444E-B0D2-6967AD62E6DB}_is1
base_handle: 0x80000001
key_handle: 0x00000000
options: 0
access: 0x00000001
regkey: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Uninstall\{C9CC97F1-09C2-444E-B0D2-6967AD62E6DB}_is1
2 0
host 91.195.240.94
McAfee Artemis!5019B4C4D5E6
Paloalto generic.ml
Kaspersky UDS:Trojan.MSIL.Crypt.gen
Avast Win32:Malware-gen
Tencent Msil.Trojan.Crypt.Srdh
McAfee-GW-Edition BehavesLike.Win32.CSDImonetize.tc
SentinelOne Static AI - Suspicious PE
Kingsoft Win32.Troj.Undef.(kcloud)
Microsoft Trojan:Win32/AgentTesla!ml
ZoneAlarm HEUR:Trojan.MSIL.Crypt.gen
BitDefenderTheta Gen:NN.ZemsilF.34170.Am0@aGOb07m
Malwarebytes Malware.AI.4239936026
Yandex Trojan.Crypt!uzIvs3R2M+I
AVG Win32:Malware-gen