Summary | ZeroBOX

Category	Machine	Started	Completed
FILE	s1_win7_x6402	Oct. 14, 2021, 9:32 a.m.	Oct. 14, 2021, 9:38 a.m.

Size	608.0KB
Type	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
MD5	`6d1b3c54bc3fa0ff9cc64c098ed90af2`
SHA256	`244ba69f8606e6c36efdf5624280f705c53342a80712db5a8f953d4f597a00d7`
CRC32	`F28A3B80`
ssdeep	`12288:RZGQdqOGZRJqydLqQSeCqsVK8kPRGO35N9mVRzXc6:RZ0XWjeCVVK8kP9N9o9`
PDB Path	c:\Cause\417\Organ\Out vi\grand.pdb
Yara	PE_Header_Zero - PE File Signature IsPE32 - (no description) Win32_Trojan_Gen_2_0904B0_Zero - Win32 Trojan Gen IsDLL - (no description) Malicious_Library_Zero - Malicious_Library Win32_Trojan_Gen_1_0904B0_Zero - Win32 Trojan Emotet

rundll32.exe "C:\Windows\System32\rundll32.exe" C:\Users\test22\AppData\Local\Temp\uidequf.jpg.dll,DictionaryProcess
1660
rundll32.exe "C:\Windows\System32\rundll32.exe" C:\Users\test22\AppData\Local\Temp\uidequf.jpg.dll,Horsefraction
1080
rundll32.exe "C:\Windows\System32\rundll32.exe" C:\Users\test22\AppData\Local\Temp\uidequf.jpg.dll,Pitch
2256
rundll32.exe "C:\Windows\System32\rundll32.exe" C:\Users\test22\AppData\Local\Temp\uidequf.jpg.dll,
2392

Name	Response	Post-Analysis Lookup
No hosts contacted.

IP Address	Status	Action
164.124.101.2	Active	Moloch

Suricata Alerts

No Suricata Alerts

Suricata TLS

No Suricata TLS

This executable has a PDB path (1 event)

pdb_path

c:\Cause\417\Organ\Out vi\grand.pdb

One or more processes crashed (50 out of 105 events)

Time & API	Arguments	Status
__exception__ Oct. 14, 2021, 9:32 a.m.	stacktrace: exception.instruction_r: cc c3 5d c3 33 c0 5d c3 68 e0 7d b6 c0 68 ea b3 exception.instruction: int3 exception.exception_code: 0x80000003 exception.symbol: DllRegisterServer+0x72ec uidequf+0x1105c exception.address: 0x1c3105c registers.esp: 1570008 registers.edi: 6694768 registers.eax: 2008080422 registers.ebp: 2008154697 registers.edx: 129161 registers.ebx: 2704346981 registers.esi: 1990393856 registers.ecx: 66040	1
__exception__ Oct. 14, 2021, 9:32 a.m.	stacktrace: exception.instruction_r: cc c3 5d c3 33 c0 5d c3 68 e0 7d b6 c0 68 ea b3 exception.instruction: int3 exception.exception_code: 0x80000003 exception.symbol: DllRegisterServer+0x72ec uidequf+0x1105c exception.address: 0x1c3105c registers.esp: 1569984 registers.edi: 16 registers.eax: 2008080422 registers.ebp: 33818576 registers.edx: 0 registers.ebx: 0 registers.esi: 64 registers.ecx: 0	1
__exception__ Oct. 14, 2021, 9:32 a.m.	stacktrace: exception.instruction_r: cc c3 5d c3 33 c0 5d c3 68 e0 7d b6 c0 68 ea b3 exception.instruction: int3 exception.exception_code: 0x80000003 exception.symbol: DllRegisterServer+0x72ec uidequf+0x1105c exception.address: 0x1c3105c registers.esp: 1569984 registers.edi: 15 registers.eax: 2008080422 registers.ebp: 33818592 registers.edx: 0 registers.ebx: 0 registers.esi: 64 registers.ecx: 0	1
__exception__ Oct. 14, 2021, 9:32 a.m.	stacktrace: exception.instruction_r: cc c3 5d c3 33 c0 5d c3 68 e0 7d b6 c0 68 ea b3 exception.instruction: int3 exception.exception_code: 0x80000003 exception.symbol: DllRegisterServer+0x72ec uidequf+0x1105c exception.address: 0x1c3105c registers.esp: 1569984 registers.edi: 14 registers.eax: 2008080422 registers.ebp: 33818608 registers.edx: 0 registers.ebx: 0 registers.esi: 64 registers.ecx: 0	1
__exception__ Oct. 14, 2021, 9:32 a.m.	stacktrace: exception.instruction_r: cc c3 5d c3 33 c0 5d c3 68 e0 7d b6 c0 68 ea b3 exception.instruction: int3 exception.exception_code: 0x80000003 exception.symbol: DllRegisterServer+0x72ec uidequf+0x1105c exception.address: 0x1c3105c registers.esp: 1569984 registers.edi: 13 registers.eax: 2008080422 registers.ebp: 33818624 registers.edx: 0 registers.ebx: 0 registers.esi: 64 registers.ecx: 0	1
__exception__ Oct. 14, 2021, 9:32 a.m.	stacktrace: exception.instruction_r: cc c3 5d c3 33 c0 5d c3 68 e0 7d b6 c0 68 ea b3 exception.instruction: int3 exception.exception_code: 0x80000003 exception.symbol: DllRegisterServer+0x72ec uidequf+0x1105c exception.address: 0x1c3105c registers.esp: 1569984 registers.edi: 12 registers.eax: 2008080422 registers.ebp: 33818640 registers.edx: 0 registers.ebx: 0 registers.esi: 64 registers.ecx: 0	1
__exception__ Oct. 14, 2021, 9:32 a.m.	stacktrace: exception.instruction_r: cc c3 5d c3 33 c0 5d c3 68 e0 7d b6 c0 68 ea b3 exception.instruction: int3 exception.exception_code: 0x80000003 exception.symbol: DllRegisterServer+0x72ec uidequf+0x1105c exception.address: 0x1c3105c registers.esp: 1569984 registers.edi: 11 registers.eax: 2008080422 registers.ebp: 33818656 registers.edx: 0 registers.ebx: 0 registers.esi: 64 registers.ecx: 0	1
__exception__ Oct. 14, 2021, 9:32 a.m.	stacktrace: exception.instruction_r: cc c3 5d c3 33 c0 5d c3 68 e0 7d b6 c0 68 ea b3 exception.instruction: int3 exception.exception_code: 0x80000003 exception.symbol: DllRegisterServer+0x72ec uidequf+0x1105c exception.address: 0x1c3105c registers.esp: 1569984 registers.edi: 10 registers.eax: 2008080422 registers.ebp: 33818672 registers.edx: 0 registers.ebx: 0 registers.esi: 64 registers.ecx: 0	1
__exception__ Oct. 14, 2021, 9:32 a.m.	stacktrace: exception.instruction_r: cc c3 5d c3 33 c0 5d c3 68 e0 7d b6 c0 68 ea b3 exception.instruction: int3 exception.exception_code: 0x80000003 exception.symbol: DllRegisterServer+0x72ec uidequf+0x1105c exception.address: 0x1c3105c registers.esp: 1569984 registers.edi: 9 registers.eax: 2008080422 registers.ebp: 33818688 registers.edx: 0 registers.ebx: 0 registers.esi: 64 registers.ecx: 0	1
__exception__ Oct. 14, 2021, 9:32 a.m.	stacktrace: exception.instruction_r: cc c3 5d c3 33 c0 5d c3 68 e0 7d b6 c0 68 ea b3 exception.instruction: int3 exception.exception_code: 0x80000003 exception.symbol: DllRegisterServer+0x72ec uidequf+0x1105c exception.address: 0x1c3105c registers.esp: 1569984 registers.edi: 8 registers.eax: 2008080422 registers.ebp: 33818704 registers.edx: 0 registers.ebx: 0 registers.esi: 64 registers.ecx: 0	1
__exception__ Oct. 14, 2021, 9:32 a.m.	stacktrace: exception.instruction_r: cc c3 5d c3 33 c0 5d c3 68 e0 7d b6 c0 68 ea b3 exception.instruction: int3 exception.exception_code: 0x80000003 exception.symbol: DllRegisterServer+0x72ec uidequf+0x1105c exception.address: 0x1c3105c registers.esp: 1569984 registers.edi: 7 registers.eax: 2008080422 registers.ebp: 33818720 registers.edx: 0 registers.ebx: 0 registers.esi: 64 registers.ecx: 0	1
__exception__ Oct. 14, 2021, 9:32 a.m.	stacktrace: exception.instruction_r: cc c3 5d c3 33 c0 5d c3 68 e0 7d b6 c0 68 ea b3 exception.instruction: int3 exception.exception_code: 0x80000003 exception.symbol: DllRegisterServer+0x72ec uidequf+0x1105c exception.address: 0x1c3105c registers.esp: 1569984 registers.edi: 6 registers.eax: 2008080422 registers.ebp: 33818736 registers.edx: 0 registers.ebx: 0 registers.esi: 64 registers.ecx: 0	1
__exception__ Oct. 14, 2021, 9:32 a.m.	stacktrace: exception.instruction_r: cc c3 5d c3 33 c0 5d c3 68 e0 7d b6 c0 68 ea b3 exception.instruction: int3 exception.exception_code: 0x80000003 exception.symbol: DllRegisterServer+0x72ec uidequf+0x1105c exception.address: 0x1c3105c registers.esp: 1569984 registers.edi: 5 registers.eax: 2008080422 registers.ebp: 33818752 registers.edx: 0 registers.ebx: 0 registers.esi: 64 registers.ecx: 0	1
__exception__ Oct. 14, 2021, 9:32 a.m.	stacktrace: exception.instruction_r: cc c3 5d c3 33 c0 5d c3 68 e0 7d b6 c0 68 ea b3 exception.instruction: int3 exception.exception_code: 0x80000003 exception.symbol: DllRegisterServer+0x72ec uidequf+0x1105c exception.address: 0x1c3105c registers.esp: 1569984 registers.edi: 4 registers.eax: 2008080422 registers.ebp: 33818768 registers.edx: 0 registers.ebx: 0 registers.esi: 64 registers.ecx: 0	1
__exception__ Oct. 14, 2021, 9:32 a.m.	stacktrace: exception.instruction_r: cc c3 5d c3 33 c0 5d c3 68 e0 7d b6 c0 68 ea b3 exception.instruction: int3 exception.exception_code: 0x80000003 exception.symbol: DllRegisterServer+0x72ec uidequf+0x1105c exception.address: 0x1c3105c registers.esp: 1569984 registers.edi: 3 registers.eax: 2008080422 registers.ebp: 33818784 registers.edx: 0 registers.ebx: 0 registers.esi: 64 registers.ecx: 0	1
__exception__ Oct. 14, 2021, 9:32 a.m.	stacktrace: exception.instruction_r: cc c3 5d c3 33 c0 5d c3 68 e0 7d b6 c0 68 ea b3 exception.instruction: int3 exception.exception_code: 0x80000003 exception.symbol: DllRegisterServer+0x72ec uidequf+0x1105c exception.address: 0x1c3105c registers.esp: 1569984 registers.edi: 2 registers.eax: 2008080422 registers.ebp: 33818800 registers.edx: 0 registers.ebx: 0 registers.esi: 64 registers.ecx: 0	1
__exception__ Oct. 14, 2021, 9:32 a.m.	stacktrace: exception.instruction_r: cc c3 5d c3 33 c0 5d c3 68 e0 7d b6 c0 68 ea b3 exception.instruction: int3 exception.exception_code: 0x80000003 exception.symbol: DllRegisterServer+0x72ec uidequf+0x1105c exception.address: 0x1c3105c registers.esp: 1569984 registers.edi: 1 registers.eax: 2008080422 registers.ebp: 33818816 registers.edx: 0 registers.ebx: 0 registers.esi: 64 registers.ecx: 0	1
__exception__ Oct. 14, 2021, 9:32 a.m.	stacktrace: DllRegisterServer+0xcbc7 uidequf+0x16937 @ 0x1c36937 exception.instruction_r: cc c3 5d c3 33 c0 5d c3 68 e0 7d b6 c0 68 ea b3 exception.instruction: int3 exception.exception_code: 0x80000003 exception.symbol: DllRegisterServer+0x72ec uidequf+0x1105c exception.address: 0x1c3105c registers.esp: 1569176 registers.edi: 12 registers.eax: 2008080422 registers.ebp: 1570252 registers.edx: 23 registers.ebx: 1570268 registers.esi: 23 registers.ecx: 0	1
__exception__ Oct. 14, 2021, 9:32 a.m.	stacktrace: exception.instruction_r: cc c3 5d c3 33 c0 5d c3 68 e0 7d b6 c0 68 ea b3 exception.instruction: int3 exception.exception_code: 0x80000003 exception.symbol: DllRegisterServer+0x72ec uidequf+0x1105c exception.address: 0x1c3105c registers.esp: 1570236 registers.edi: 6 registers.eax: 2008080422 registers.ebp: 96784 registers.edx: 827898 registers.ebx: 0 registers.esi: 282 registers.ecx: 0	1
__exception__ Oct. 14, 2021, 9:32 a.m.	stacktrace: exception.instruction_r: cc c3 5d c3 33 c0 5d c3 68 e0 7d b6 c0 68 ea b3 exception.instruction: int3 exception.exception_code: 0x80000003 exception.symbol: DllRegisterServer+0x72ec uidequf+0x1105c exception.address: 0x1c3105c registers.esp: 1570212 registers.edi: 6 registers.eax: 2008080422 registers.ebp: 16 registers.edx: 0 registers.ebx: 64 registers.esi: 33822056 registers.ecx: 0	1
__exception__ Oct. 14, 2021, 9:32 a.m.	stacktrace: exception.instruction_r: cc c3 5d c3 33 c0 5d c3 68 e0 7d b6 c0 68 ea b3 exception.instruction: int3 exception.exception_code: 0x80000003 exception.symbol: DllRegisterServer+0x72ec uidequf+0x1105c exception.address: 0x1c3105c registers.esp: 1570212 registers.edi: 6 registers.eax: 2008080422 registers.ebp: 15 registers.edx: 0 registers.ebx: 64 registers.esi: 33822080 registers.ecx: 0	1
__exception__ Oct. 14, 2021, 9:32 a.m.	stacktrace: exception.instruction_r: cc c3 5d c3 33 c0 5d c3 68 e0 7d b6 c0 68 ea b3 exception.instruction: int3 exception.exception_code: 0x80000003 exception.symbol: DllRegisterServer+0x72ec uidequf+0x1105c exception.address: 0x1c3105c registers.esp: 1570212 registers.edi: 6 registers.eax: 2008080422 registers.ebp: 14 registers.edx: 0 registers.ebx: 64 registers.esi: 33822104 registers.ecx: 0	1
__exception__ Oct. 14, 2021, 9:32 a.m.	stacktrace: exception.instruction_r: cc c3 5d c3 33 c0 5d c3 68 e0 7d b6 c0 68 ea b3 exception.instruction: int3 exception.exception_code: 0x80000003 exception.symbol: DllRegisterServer+0x72ec uidequf+0x1105c exception.address: 0x1c3105c registers.esp: 1570212 registers.edi: 6 registers.eax: 2008080422 registers.ebp: 13 registers.edx: 0 registers.ebx: 64 registers.esi: 33822128 registers.ecx: 0	1
__exception__ Oct. 14, 2021, 9:32 a.m.	stacktrace: exception.instruction_r: cc c3 5d c3 33 c0 5d c3 68 e0 7d b6 c0 68 ea b3 exception.instruction: int3 exception.exception_code: 0x80000003 exception.symbol: DllRegisterServer+0x72ec uidequf+0x1105c exception.address: 0x1c3105c registers.esp: 1570212 registers.edi: 6 registers.eax: 2008080422 registers.ebp: 12 registers.edx: 0 registers.ebx: 64 registers.esi: 33822152 registers.ecx: 0	1
__exception__ Oct. 14, 2021, 9:32 a.m.	stacktrace: exception.instruction_r: cc c3 5d c3 33 c0 5d c3 68 e0 7d b6 c0 68 ea b3 exception.instruction: int3 exception.exception_code: 0x80000003 exception.symbol: DllRegisterServer+0x72ec uidequf+0x1105c exception.address: 0x1c3105c registers.esp: 1570212 registers.edi: 6 registers.eax: 2008080422 registers.ebp: 11 registers.edx: 0 registers.ebx: 64 registers.esi: 33822176 registers.ecx: 0	1
__exception__ Oct. 14, 2021, 9:32 a.m.	stacktrace: exception.instruction_r: cc c3 5d c3 33 c0 5d c3 68 e0 7d b6 c0 68 ea b3 exception.instruction: int3 exception.exception_code: 0x80000003 exception.symbol: DllRegisterServer+0x72ec uidequf+0x1105c exception.address: 0x1c3105c registers.esp: 1570212 registers.edi: 6 registers.eax: 2008080422 registers.ebp: 10 registers.edx: 0 registers.ebx: 64 registers.esi: 33822200 registers.ecx: 0	1
__exception__ Oct. 14, 2021, 9:32 a.m.	stacktrace: exception.instruction_r: cc c3 5d c3 33 c0 5d c3 68 e0 7d b6 c0 68 ea b3 exception.instruction: int3 exception.exception_code: 0x80000003 exception.symbol: DllRegisterServer+0x72ec uidequf+0x1105c exception.address: 0x1c3105c registers.esp: 1570212 registers.edi: 6 registers.eax: 2008080422 registers.ebp: 9 registers.edx: 0 registers.ebx: 64 registers.esi: 33822224 registers.ecx: 0	1
__exception__ Oct. 14, 2021, 9:32 a.m.	stacktrace: exception.instruction_r: cc c3 5d c3 33 c0 5d c3 68 e0 7d b6 c0 68 ea b3 exception.instruction: int3 exception.exception_code: 0x80000003 exception.symbol: DllRegisterServer+0x72ec uidequf+0x1105c exception.address: 0x1c3105c registers.esp: 1570212 registers.edi: 6 registers.eax: 2008080422 registers.ebp: 8 registers.edx: 0 registers.ebx: 64 registers.esi: 33822248 registers.ecx: 0	1
__exception__ Oct. 14, 2021, 9:32 a.m.	stacktrace: exception.instruction_r: cc c3 5d c3 33 c0 5d c3 68 e0 7d b6 c0 68 ea b3 exception.instruction: int3 exception.exception_code: 0x80000003 exception.symbol: DllRegisterServer+0x72ec uidequf+0x1105c exception.address: 0x1c3105c registers.esp: 1570212 registers.edi: 6 registers.eax: 2008080422 registers.ebp: 7 registers.edx: 0 registers.ebx: 64 registers.esi: 33822272 registers.ecx: 0	1
__exception__ Oct. 14, 2021, 9:32 a.m.	stacktrace: exception.instruction_r: cc c3 5d c3 33 c0 5d c3 68 e0 7d b6 c0 68 ea b3 exception.instruction: int3 exception.exception_code: 0x80000003 exception.symbol: DllRegisterServer+0x72ec uidequf+0x1105c exception.address: 0x1c3105c registers.esp: 1570212 registers.edi: 6 registers.eax: 2008080422 registers.ebp: 6 registers.edx: 0 registers.ebx: 64 registers.esi: 33822296 registers.ecx: 0	1
__exception__ Oct. 14, 2021, 9:32 a.m.	stacktrace: exception.instruction_r: cc c3 5d c3 33 c0 5d c3 68 e0 7d b6 c0 68 ea b3 exception.instruction: int3 exception.exception_code: 0x80000003 exception.symbol: DllRegisterServer+0x72ec uidequf+0x1105c exception.address: 0x1c3105c registers.esp: 1570212 registers.edi: 6 registers.eax: 2008080422 registers.ebp: 5 registers.edx: 0 registers.ebx: 64 registers.esi: 33822320 registers.ecx: 0	1
__exception__ Oct. 14, 2021, 9:32 a.m.	stacktrace: exception.instruction_r: cc c3 5d c3 33 c0 5d c3 68 e0 7d b6 c0 68 ea b3 exception.instruction: int3 exception.exception_code: 0x80000003 exception.symbol: DllRegisterServer+0x72ec uidequf+0x1105c exception.address: 0x1c3105c registers.esp: 1570212 registers.edi: 6 registers.eax: 2008080422 registers.ebp: 4 registers.edx: 0 registers.ebx: 64 registers.esi: 33822344 registers.ecx: 0	1
__exception__ Oct. 14, 2021, 9:32 a.m.	stacktrace: exception.instruction_r: cc c3 5d c3 33 c0 5d c3 68 e0 7d b6 c0 68 ea b3 exception.instruction: int3 exception.exception_code: 0x80000003 exception.symbol: DllRegisterServer+0x72ec uidequf+0x1105c exception.address: 0x1c3105c registers.esp: 1570212 registers.edi: 6 registers.eax: 2008080422 registers.ebp: 3 registers.edx: 0 registers.ebx: 64 registers.esi: 33822368 registers.ecx: 0	1
__exception__ Oct. 14, 2021, 9:32 a.m.	stacktrace: exception.instruction_r: cc c3 5d c3 33 c0 5d c3 68 e0 7d b6 c0 68 ea b3 exception.instruction: int3 exception.exception_code: 0x80000003 exception.symbol: DllRegisterServer+0x72ec uidequf+0x1105c exception.address: 0x1c3105c registers.esp: 1570212 registers.edi: 6 registers.eax: 2008080422 registers.ebp: 2 registers.edx: 0 registers.ebx: 64 registers.esi: 33822392 registers.ecx: 0	1
__exception__ Oct. 14, 2021, 9:32 a.m.	stacktrace: exception.instruction_r: cc c3 5d c3 33 c0 5d c3 68 e0 7d b6 c0 68 ea b3 exception.instruction: int3 exception.exception_code: 0x80000003 exception.symbol: DllRegisterServer+0x72ec uidequf+0x1105c exception.address: 0x1c3105c registers.esp: 1570212 registers.edi: 6 registers.eax: 2008080422 registers.ebp: 1 registers.edx: 0 registers.ebx: 64 registers.esi: 33822416 registers.ecx: 0	1
__exception__ Oct. 14, 2021, 9:32 a.m.	stacktrace: exception.instruction_r: cc c3 5d c3 33 c0 5d c3 68 e0 7d b6 c0 68 ea b3 exception.instruction: int3 exception.exception_code: 0x80000003 exception.symbol: DllRegisterServer+0x72ec uidequf+0x1105c exception.address: 0x87105c registers.esp: 2421732 registers.edi: 6563688 registers.eax: 2008080422 registers.ebp: 2008154697 registers.edx: 129161 registers.ebx: 2704346981 registers.esi: 1990393856 registers.ecx: 66040	1
__exception__ Oct. 14, 2021, 9:32 a.m.	stacktrace: exception.instruction_r: cc c3 5d c3 33 c0 5d c3 68 e0 7d b6 c0 68 ea b3 exception.instruction: int3 exception.exception_code: 0x80000003 exception.symbol: DllRegisterServer+0x72ec uidequf+0x1105c exception.address: 0x87105c registers.esp: 2421708 registers.edi: 16 registers.eax: 2008080422 registers.ebp: 11667408 registers.edx: 0 registers.ebx: 0 registers.esi: 64 registers.ecx: 0	1
__exception__ Oct. 14, 2021, 9:32 a.m.	stacktrace: exception.instruction_r: cc c3 5d c3 33 c0 5d c3 68 e0 7d b6 c0 68 ea b3 exception.instruction: int3 exception.exception_code: 0x80000003 exception.symbol: DllRegisterServer+0x72ec uidequf+0x1105c exception.address: 0x87105c registers.esp: 2421708 registers.edi: 15 registers.eax: 2008080422 registers.ebp: 11667424 registers.edx: 0 registers.ebx: 0 registers.esi: 64 registers.ecx: 0	1
__exception__ Oct. 14, 2021, 9:32 a.m.	stacktrace: exception.instruction_r: cc c3 5d c3 33 c0 5d c3 68 e0 7d b6 c0 68 ea b3 exception.instruction: int3 exception.exception_code: 0x80000003 exception.symbol: DllRegisterServer+0x72ec uidequf+0x1105c exception.address: 0x87105c registers.esp: 2421708 registers.edi: 14 registers.eax: 2008080422 registers.ebp: 11667440 registers.edx: 0 registers.ebx: 0 registers.esi: 64 registers.ecx: 0	1
__exception__ Oct. 14, 2021, 9:32 a.m.	stacktrace: exception.instruction_r: cc c3 5d c3 33 c0 5d c3 68 e0 7d b6 c0 68 ea b3 exception.instruction: int3 exception.exception_code: 0x80000003 exception.symbol: DllRegisterServer+0x72ec uidequf+0x1105c exception.address: 0x87105c registers.esp: 2421708 registers.edi: 13 registers.eax: 2008080422 registers.ebp: 11667456 registers.edx: 0 registers.ebx: 0 registers.esi: 64 registers.ecx: 0	1
__exception__ Oct. 14, 2021, 9:32 a.m.	stacktrace: exception.instruction_r: cc c3 5d c3 33 c0 5d c3 68 e0 7d b6 c0 68 ea b3 exception.instruction: int3 exception.exception_code: 0x80000003 exception.symbol: DllRegisterServer+0x72ec uidequf+0x1105c exception.address: 0x87105c registers.esp: 2421708 registers.edi: 12 registers.eax: 2008080422 registers.ebp: 11667472 registers.edx: 0 registers.ebx: 0 registers.esi: 64 registers.ecx: 0	1
__exception__ Oct. 14, 2021, 9:32 a.m.	stacktrace: exception.instruction_r: cc c3 5d c3 33 c0 5d c3 68 e0 7d b6 c0 68 ea b3 exception.instruction: int3 exception.exception_code: 0x80000003 exception.symbol: DllRegisterServer+0x72ec uidequf+0x1105c exception.address: 0x87105c registers.esp: 2421708 registers.edi: 11 registers.eax: 2008080422 registers.ebp: 11667488 registers.edx: 0 registers.ebx: 0 registers.esi: 64 registers.ecx: 0	1
__exception__ Oct. 14, 2021, 9:32 a.m.	stacktrace: exception.instruction_r: cc c3 5d c3 33 c0 5d c3 68 e0 7d b6 c0 68 ea b3 exception.instruction: int3 exception.exception_code: 0x80000003 exception.symbol: DllRegisterServer+0x72ec uidequf+0x1105c exception.address: 0x87105c registers.esp: 2421708 registers.edi: 10 registers.eax: 2008080422 registers.ebp: 11667504 registers.edx: 0 registers.ebx: 0 registers.esi: 64 registers.ecx: 0	1
__exception__ Oct. 14, 2021, 9:32 a.m.	stacktrace: exception.instruction_r: cc c3 5d c3 33 c0 5d c3 68 e0 7d b6 c0 68 ea b3 exception.instruction: int3 exception.exception_code: 0x80000003 exception.symbol: DllRegisterServer+0x72ec uidequf+0x1105c exception.address: 0x87105c registers.esp: 2421708 registers.edi: 9 registers.eax: 2008080422 registers.ebp: 11667520 registers.edx: 0 registers.ebx: 0 registers.esi: 64 registers.ecx: 0	1
__exception__ Oct. 14, 2021, 9:32 a.m.	stacktrace: exception.instruction_r: cc c3 5d c3 33 c0 5d c3 68 e0 7d b6 c0 68 ea b3 exception.instruction: int3 exception.exception_code: 0x80000003 exception.symbol: DllRegisterServer+0x72ec uidequf+0x1105c exception.address: 0x87105c registers.esp: 2421708 registers.edi: 8 registers.eax: 2008080422 registers.ebp: 11667536 registers.edx: 0 registers.ebx: 0 registers.esi: 64 registers.ecx: 0	1
__exception__ Oct. 14, 2021, 9:32 a.m.	stacktrace: exception.instruction_r: cc c3 5d c3 33 c0 5d c3 68 e0 7d b6 c0 68 ea b3 exception.instruction: int3 exception.exception_code: 0x80000003 exception.symbol: DllRegisterServer+0x72ec uidequf+0x1105c exception.address: 0x87105c registers.esp: 2421708 registers.edi: 7 registers.eax: 2008080422 registers.ebp: 11667552 registers.edx: 0 registers.ebx: 0 registers.esi: 64 registers.ecx: 0	1
__exception__ Oct. 14, 2021, 9:32 a.m.	stacktrace: exception.instruction_r: cc c3 5d c3 33 c0 5d c3 68 e0 7d b6 c0 68 ea b3 exception.instruction: int3 exception.exception_code: 0x80000003 exception.symbol: DllRegisterServer+0x72ec uidequf+0x1105c exception.address: 0x87105c registers.esp: 2421708 registers.edi: 6 registers.eax: 2008080422 registers.ebp: 11667568 registers.edx: 0 registers.ebx: 0 registers.esi: 64 registers.ecx: 0	1
__exception__ Oct. 14, 2021, 9:32 a.m.	stacktrace: exception.instruction_r: cc c3 5d c3 33 c0 5d c3 68 e0 7d b6 c0 68 ea b3 exception.instruction: int3 exception.exception_code: 0x80000003 exception.symbol: DllRegisterServer+0x72ec uidequf+0x1105c exception.address: 0x87105c registers.esp: 2421708 registers.edi: 5 registers.eax: 2008080422 registers.ebp: 11667584 registers.edx: 0 registers.ebx: 0 registers.esi: 64 registers.ecx: 0	1
__exception__ Oct. 14, 2021, 9:32 a.m.	stacktrace: exception.instruction_r: cc c3 5d c3 33 c0 5d c3 68 e0 7d b6 c0 68 ea b3 exception.instruction: int3 exception.exception_code: 0x80000003 exception.symbol: DllRegisterServer+0x72ec uidequf+0x1105c exception.address: 0x87105c registers.esp: 2421708 registers.edi: 4 registers.eax: 2008080422 registers.ebp: 11667600 registers.edx: 0 registers.ebx: 0 registers.esi: 64 registers.ecx: 0	1
__exception__ Oct. 14, 2021, 9:32 a.m.	stacktrace: exception.instruction_r: cc c3 5d c3 33 c0 5d c3 68 e0 7d b6 c0 68 ea b3 exception.instruction: int3 exception.exception_code: 0x80000003 exception.symbol: DllRegisterServer+0x72ec uidequf+0x1105c exception.address: 0x87105c registers.esp: 2421708 registers.edi: 3 registers.eax: 2008080422 registers.ebp: 11667616 registers.edx: 0 registers.ebx: 0 registers.esi: 64 registers.ecx: 0	1

Allocates read-write-execute memory (usually to unpack itself) (18 events)

Time & API	Arguments	Status
NtProtectVirtualMemory Oct. 14, 2021, 9:32 a.m.	process_identifier: 1660 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x01c4d000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Oct. 14, 2021, 9:32 a.m.	process_identifier: 1660 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x73fe1000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Oct. 14, 2021, 9:32 a.m.	process_identifier: 1660 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 24576 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x01cb4000 process_handle: 0xffffffff	1
NtAllocateVirtualMemory Oct. 14, 2021, 9:32 a.m.	process_identifier: 1660 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x01bc0000 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Oct. 14, 2021, 9:32 a.m.	process_identifier: 1660 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x01da0000 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Oct. 14, 2021, 9:32 a.m.	process_identifier: 1660 region_size: 614400 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x01f20000 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0xffffffff	1
NtProtectVirtualMemory Oct. 14, 2021, 9:32 a.m.	process_identifier: 1080 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0088d000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Oct. 14, 2021, 9:32 a.m.	process_identifier: 1080 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x73fe1000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Oct. 14, 2021, 9:32 a.m.	process_identifier: 1080 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 24576 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x008f4000 process_handle: 0xffffffff	1
NtAllocateVirtualMemory Oct. 14, 2021, 9:32 a.m.	process_identifier: 1080 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00800000 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Oct. 14, 2021, 9:32 a.m.	process_identifier: 1080 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00810000 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Oct. 14, 2021, 9:32 a.m.	process_identifier: 1080 region_size: 614400 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00ad0000 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0xffffffff	1
NtProtectVirtualMemory Oct. 14, 2021, 9:32 a.m.	process_identifier: 2256 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0048d000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Oct. 14, 2021, 9:32 a.m.	process_identifier: 2256 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x73fe1000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Oct. 14, 2021, 9:32 a.m.	process_identifier: 2256 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 24576 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x004f4000 process_handle: 0xffffffff	1
NtAllocateVirtualMemory Oct. 14, 2021, 9:32 a.m.	process_identifier: 2256 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00350000 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Oct. 14, 2021, 9:32 a.m.	process_identifier: 2256 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00360000 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Oct. 14, 2021, 9:32 a.m.	process_identifier: 2256 region_size: 614400 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00ae0000 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0xffffffff	1

File has been identified by 10 AntiVirus engines on VirusTotal as malicious (10 events)

Elastic	malicious (high confidence)
Cylance	Unsafe
CrowdStrike	win/malicious_confidence_100% (W)
APEX	Malicious
Kaspersky	UDS:Trojan-Banker.Win32.Cridex.gen
Sophos	ML/PE-A
SentinelOne	Static AI - Suspicious PE
Webroot	W32.Trojan.Gen
Microsoft	Trojan:Win32/Sabsik.FL.B!ml
ZoneAlarm	UDS:DangerousObject.Multi.Generic

uidequf.jpg

Process Tree Toggle all

Network Toggle all

Suricata Toggle all

Suricata Alerts

Suricata TLS

Signatures Toggle All