Summary | ZeroBOX

Category	Machine	Started	Completed
FILE	s1_win7_x6402	Oct. 14, 2021, 5:17 p.m.	Oct. 14, 2021, 5:26 p.m.

Size	608.0KB
Type	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
MD5	`cb1c5d7a7e086e67e22abe9eab31db50`
SHA256	`4f1d3b3120b815c18d793a42af59b473cbf50d364d671f1afafde5126b2b3a52`
CRC32	`A2A08258`
ssdeep	`12288:bZGQdqOGBWJqydLqQSeCqsVK8kPRGO35N9mVOzXc6:bZ00WjeCVVK8kP9N9oa`
PDB Path	c:\Cause\417\Organ\Out vi\grand.pdb
Yara	PE_Header_Zero - PE File Signature IsPE32 - (no description) Win32_Trojan_Gen_2_0904B0_Zero - Win32 Trojan Gen IsDLL - (no description) Malicious_Library_Zero - Malicious_Library Win32_Trojan_Gen_1_0904B0_Zero - Win32 Trojan Emotet

rundll32.exe "C:\Windows\System32\rundll32.exe" C:\Users\test22\AppData\Local\Temp\c78zdj.jpg.dll,DictionaryProcess
1548
rundll32.exe "C:\Windows\System32\rundll32.exe" C:\Users\test22\AppData\Local\Temp\c78zdj.jpg.dll,Horsefraction
1772
rundll32.exe "C:\Windows\System32\rundll32.exe" C:\Users\test22\AppData\Local\Temp\c78zdj.jpg.dll,Pitch
688
rundll32.exe "C:\Windows\System32\rundll32.exe" C:\Users\test22\AppData\Local\Temp\c78zdj.jpg.dll,
508

Name	Response	Post-Analysis Lookup
No hosts contacted.

IP Address	Status	Action
131.153.76.130	Active	Moloch
164.124.101.2	Active	Moloch

Suricata Alerts

No Suricata Alerts

Suricata TLS

No Suricata TLS

This executable has a PDB path (1 event)

pdb_path

c:\Cause\417\Organ\Out vi\grand.pdb

One or more processes crashed (50 out of 105 events)

Time & API	Arguments	Status
__exception__ Oct. 14, 2021, 5:17 p.m.	stacktrace: exception.instruction_r: cc c3 5d c3 33 c0 5d c3 68 e0 7d b6 c0 68 ea b3 exception.instruction: int3 exception.exception_code: 0x80000003 exception.symbol: DllRegisterServer+0x72ec c78zdj+0x1105c exception.address: 0x86105c registers.esp: 2027284 registers.edi: 4597608 registers.eax: 2008080422 registers.ebp: 2008154697 registers.edx: 129161 registers.ebx: 2704346981 registers.esi: 1990393856 registers.ecx: 66040	1
__exception__ Oct. 14, 2021, 5:17 p.m.	stacktrace: exception.instruction_r: cc c3 5d c3 33 c0 5d c3 68 e0 7d b6 c0 68 ea b3 exception.instruction: int3 exception.exception_code: 0x80000003 exception.symbol: DllRegisterServer+0x72ec c78zdj+0x1105c exception.address: 0x86105c registers.esp: 2027260 registers.edi: 16 registers.eax: 2008080422 registers.ebp: 35784656 registers.edx: 0 registers.ebx: 0 registers.esi: 64 registers.ecx: 0	1
__exception__ Oct. 14, 2021, 5:17 p.m.	stacktrace: exception.instruction_r: cc c3 5d c3 33 c0 5d c3 68 e0 7d b6 c0 68 ea b3 exception.instruction: int3 exception.exception_code: 0x80000003 exception.symbol: DllRegisterServer+0x72ec c78zdj+0x1105c exception.address: 0x86105c registers.esp: 2027260 registers.edi: 15 registers.eax: 2008080422 registers.ebp: 35784672 registers.edx: 0 registers.ebx: 0 registers.esi: 64 registers.ecx: 0	1
__exception__ Oct. 14, 2021, 5:17 p.m.	stacktrace: exception.instruction_r: cc c3 5d c3 33 c0 5d c3 68 e0 7d b6 c0 68 ea b3 exception.instruction: int3 exception.exception_code: 0x80000003 exception.symbol: DllRegisterServer+0x72ec c78zdj+0x1105c exception.address: 0x86105c registers.esp: 2027260 registers.edi: 14 registers.eax: 2008080422 registers.ebp: 35784688 registers.edx: 0 registers.ebx: 0 registers.esi: 64 registers.ecx: 0	1
__exception__ Oct. 14, 2021, 5:17 p.m.	stacktrace: exception.instruction_r: cc c3 5d c3 33 c0 5d c3 68 e0 7d b6 c0 68 ea b3 exception.instruction: int3 exception.exception_code: 0x80000003 exception.symbol: DllRegisterServer+0x72ec c78zdj+0x1105c exception.address: 0x86105c registers.esp: 2027260 registers.edi: 13 registers.eax: 2008080422 registers.ebp: 35784704 registers.edx: 0 registers.ebx: 0 registers.esi: 64 registers.ecx: 0	1
__exception__ Oct. 14, 2021, 5:17 p.m.	stacktrace: exception.instruction_r: cc c3 5d c3 33 c0 5d c3 68 e0 7d b6 c0 68 ea b3 exception.instruction: int3 exception.exception_code: 0x80000003 exception.symbol: DllRegisterServer+0x72ec c78zdj+0x1105c exception.address: 0x86105c registers.esp: 2027260 registers.edi: 12 registers.eax: 2008080422 registers.ebp: 35784720 registers.edx: 0 registers.ebx: 0 registers.esi: 64 registers.ecx: 0	1
__exception__ Oct. 14, 2021, 5:17 p.m.	stacktrace: exception.instruction_r: cc c3 5d c3 33 c0 5d c3 68 e0 7d b6 c0 68 ea b3 exception.instruction: int3 exception.exception_code: 0x80000003 exception.symbol: DllRegisterServer+0x72ec c78zdj+0x1105c exception.address: 0x86105c registers.esp: 2027260 registers.edi: 11 registers.eax: 2008080422 registers.ebp: 35784736 registers.edx: 0 registers.ebx: 0 registers.esi: 64 registers.ecx: 0	1
__exception__ Oct. 14, 2021, 5:17 p.m.	stacktrace: exception.instruction_r: cc c3 5d c3 33 c0 5d c3 68 e0 7d b6 c0 68 ea b3 exception.instruction: int3 exception.exception_code: 0x80000003 exception.symbol: DllRegisterServer+0x72ec c78zdj+0x1105c exception.address: 0x86105c registers.esp: 2027260 registers.edi: 10 registers.eax: 2008080422 registers.ebp: 35784752 registers.edx: 0 registers.ebx: 0 registers.esi: 64 registers.ecx: 0	1
__exception__ Oct. 14, 2021, 5:17 p.m.	stacktrace: exception.instruction_r: cc c3 5d c3 33 c0 5d c3 68 e0 7d b6 c0 68 ea b3 exception.instruction: int3 exception.exception_code: 0x80000003 exception.symbol: DllRegisterServer+0x72ec c78zdj+0x1105c exception.address: 0x86105c registers.esp: 2027260 registers.edi: 9 registers.eax: 2008080422 registers.ebp: 35784768 registers.edx: 0 registers.ebx: 0 registers.esi: 64 registers.ecx: 0	1
__exception__ Oct. 14, 2021, 5:17 p.m.	stacktrace: exception.instruction_r: cc c3 5d c3 33 c0 5d c3 68 e0 7d b6 c0 68 ea b3 exception.instruction: int3 exception.exception_code: 0x80000003 exception.symbol: DllRegisterServer+0x72ec c78zdj+0x1105c exception.address: 0x86105c registers.esp: 2027260 registers.edi: 8 registers.eax: 2008080422 registers.ebp: 35784784 registers.edx: 0 registers.ebx: 0 registers.esi: 64 registers.ecx: 0	1
__exception__ Oct. 14, 2021, 5:17 p.m.	stacktrace: exception.instruction_r: cc c3 5d c3 33 c0 5d c3 68 e0 7d b6 c0 68 ea b3 exception.instruction: int3 exception.exception_code: 0x80000003 exception.symbol: DllRegisterServer+0x72ec c78zdj+0x1105c exception.address: 0x86105c registers.esp: 2027260 registers.edi: 7 registers.eax: 2008080422 registers.ebp: 35784800 registers.edx: 0 registers.ebx: 0 registers.esi: 64 registers.ecx: 0	1
__exception__ Oct. 14, 2021, 5:17 p.m.	stacktrace: exception.instruction_r: cc c3 5d c3 33 c0 5d c3 68 e0 7d b6 c0 68 ea b3 exception.instruction: int3 exception.exception_code: 0x80000003 exception.symbol: DllRegisterServer+0x72ec c78zdj+0x1105c exception.address: 0x86105c registers.esp: 2027260 registers.edi: 6 registers.eax: 2008080422 registers.ebp: 35784816 registers.edx: 0 registers.ebx: 0 registers.esi: 64 registers.ecx: 0	1
__exception__ Oct. 14, 2021, 5:17 p.m.	stacktrace: exception.instruction_r: cc c3 5d c3 33 c0 5d c3 68 e0 7d b6 c0 68 ea b3 exception.instruction: int3 exception.exception_code: 0x80000003 exception.symbol: DllRegisterServer+0x72ec c78zdj+0x1105c exception.address: 0x86105c registers.esp: 2027260 registers.edi: 5 registers.eax: 2008080422 registers.ebp: 35784832 registers.edx: 0 registers.ebx: 0 registers.esi: 64 registers.ecx: 0	1
__exception__ Oct. 14, 2021, 5:17 p.m.	stacktrace: exception.instruction_r: cc c3 5d c3 33 c0 5d c3 68 e0 7d b6 c0 68 ea b3 exception.instruction: int3 exception.exception_code: 0x80000003 exception.symbol: DllRegisterServer+0x72ec c78zdj+0x1105c exception.address: 0x86105c registers.esp: 2027260 registers.edi: 4 registers.eax: 2008080422 registers.ebp: 35784848 registers.edx: 0 registers.ebx: 0 registers.esi: 64 registers.ecx: 0	1
__exception__ Oct. 14, 2021, 5:17 p.m.	stacktrace: exception.instruction_r: cc c3 5d c3 33 c0 5d c3 68 e0 7d b6 c0 68 ea b3 exception.instruction: int3 exception.exception_code: 0x80000003 exception.symbol: DllRegisterServer+0x72ec c78zdj+0x1105c exception.address: 0x86105c registers.esp: 2027260 registers.edi: 3 registers.eax: 2008080422 registers.ebp: 35784864 registers.edx: 0 registers.ebx: 0 registers.esi: 64 registers.ecx: 0	1
__exception__ Oct. 14, 2021, 5:17 p.m.	stacktrace: exception.instruction_r: cc c3 5d c3 33 c0 5d c3 68 e0 7d b6 c0 68 ea b3 exception.instruction: int3 exception.exception_code: 0x80000003 exception.symbol: DllRegisterServer+0x72ec c78zdj+0x1105c exception.address: 0x86105c registers.esp: 2027260 registers.edi: 2 registers.eax: 2008080422 registers.ebp: 35784880 registers.edx: 0 registers.ebx: 0 registers.esi: 64 registers.ecx: 0	1
__exception__ Oct. 14, 2021, 5:17 p.m.	stacktrace: exception.instruction_r: cc c3 5d c3 33 c0 5d c3 68 e0 7d b6 c0 68 ea b3 exception.instruction: int3 exception.exception_code: 0x80000003 exception.symbol: DllRegisterServer+0x72ec c78zdj+0x1105c exception.address: 0x86105c registers.esp: 2027260 registers.edi: 1 registers.eax: 2008080422 registers.ebp: 35784896 registers.edx: 0 registers.ebx: 0 registers.esi: 64 registers.ecx: 0	1
__exception__ Oct. 14, 2021, 5:17 p.m.	stacktrace: DllRegisterServer+0xcbc7 c78zdj+0x16937 @ 0x866937 exception.instruction_r: cc c3 5d c3 33 c0 5d c3 68 e0 7d b6 c0 68 ea b3 exception.instruction: int3 exception.exception_code: 0x80000003 exception.symbol: DllRegisterServer+0x72ec c78zdj+0x1105c exception.address: 0x86105c registers.esp: 2026456 registers.edi: 12 registers.eax: 2008080422 registers.ebp: 2027528 registers.edx: 23 registers.ebx: 2027544 registers.esi: 23 registers.ecx: 0	1
__exception__ Oct. 14, 2021, 5:17 p.m.	stacktrace: exception.instruction_r: cc c3 5d c3 33 c0 5d c3 68 e0 7d b6 c0 68 ea b3 exception.instruction: int3 exception.exception_code: 0x80000003 exception.symbol: DllRegisterServer+0x72ec c78zdj+0x1105c exception.address: 0x86105c registers.esp: 2027512 registers.edi: 6 registers.eax: 2008080422 registers.ebp: 96784 registers.edx: 827898 registers.ebx: 0 registers.esi: 282 registers.ecx: 0	1
__exception__ Oct. 14, 2021, 5:17 p.m.	stacktrace: exception.instruction_r: cc c3 5d c3 33 c0 5d c3 68 e0 7d b6 c0 68 ea b3 exception.instruction: int3 exception.exception_code: 0x80000003 exception.symbol: DllRegisterServer+0x72ec c78zdj+0x1105c exception.address: 0x86105c registers.esp: 2027488 registers.edi: 6 registers.eax: 2008080422 registers.ebp: 16 registers.edx: 0 registers.ebx: 64 registers.esi: 35788136 registers.ecx: 0	1
__exception__ Oct. 14, 2021, 5:17 p.m.	stacktrace: exception.instruction_r: cc c3 5d c3 33 c0 5d c3 68 e0 7d b6 c0 68 ea b3 exception.instruction: int3 exception.exception_code: 0x80000003 exception.symbol: DllRegisterServer+0x72ec c78zdj+0x1105c exception.address: 0x86105c registers.esp: 2027488 registers.edi: 6 registers.eax: 2008080422 registers.ebp: 15 registers.edx: 0 registers.ebx: 64 registers.esi: 35788160 registers.ecx: 0	1
__exception__ Oct. 14, 2021, 5:17 p.m.	stacktrace: exception.instruction_r: cc c3 5d c3 33 c0 5d c3 68 e0 7d b6 c0 68 ea b3 exception.instruction: int3 exception.exception_code: 0x80000003 exception.symbol: DllRegisterServer+0x72ec c78zdj+0x1105c exception.address: 0x86105c registers.esp: 2027488 registers.edi: 6 registers.eax: 2008080422 registers.ebp: 14 registers.edx: 0 registers.ebx: 64 registers.esi: 35788184 registers.ecx: 0	1
__exception__ Oct. 14, 2021, 5:17 p.m.	stacktrace: exception.instruction_r: cc c3 5d c3 33 c0 5d c3 68 e0 7d b6 c0 68 ea b3 exception.instruction: int3 exception.exception_code: 0x80000003 exception.symbol: DllRegisterServer+0x72ec c78zdj+0x1105c exception.address: 0x86105c registers.esp: 2027488 registers.edi: 6 registers.eax: 2008080422 registers.ebp: 13 registers.edx: 0 registers.ebx: 64 registers.esi: 35788208 registers.ecx: 0	1
__exception__ Oct. 14, 2021, 5:17 p.m.	stacktrace: exception.instruction_r: cc c3 5d c3 33 c0 5d c3 68 e0 7d b6 c0 68 ea b3 exception.instruction: int3 exception.exception_code: 0x80000003 exception.symbol: DllRegisterServer+0x72ec c78zdj+0x1105c exception.address: 0x86105c registers.esp: 2027488 registers.edi: 6 registers.eax: 2008080422 registers.ebp: 12 registers.edx: 0 registers.ebx: 64 registers.esi: 35788232 registers.ecx: 0	1
__exception__ Oct. 14, 2021, 5:17 p.m.	stacktrace: exception.instruction_r: cc c3 5d c3 33 c0 5d c3 68 e0 7d b6 c0 68 ea b3 exception.instruction: int3 exception.exception_code: 0x80000003 exception.symbol: DllRegisterServer+0x72ec c78zdj+0x1105c exception.address: 0x86105c registers.esp: 2027488 registers.edi: 6 registers.eax: 2008080422 registers.ebp: 11 registers.edx: 0 registers.ebx: 64 registers.esi: 35788256 registers.ecx: 0	1
__exception__ Oct. 14, 2021, 5:17 p.m.	stacktrace: exception.instruction_r: cc c3 5d c3 33 c0 5d c3 68 e0 7d b6 c0 68 ea b3 exception.instruction: int3 exception.exception_code: 0x80000003 exception.symbol: DllRegisterServer+0x72ec c78zdj+0x1105c exception.address: 0x86105c registers.esp: 2027488 registers.edi: 6 registers.eax: 2008080422 registers.ebp: 10 registers.edx: 0 registers.ebx: 64 registers.esi: 35788280 registers.ecx: 0	1
__exception__ Oct. 14, 2021, 5:17 p.m.	stacktrace: exception.instruction_r: cc c3 5d c3 33 c0 5d c3 68 e0 7d b6 c0 68 ea b3 exception.instruction: int3 exception.exception_code: 0x80000003 exception.symbol: DllRegisterServer+0x72ec c78zdj+0x1105c exception.address: 0x86105c registers.esp: 2027488 registers.edi: 6 registers.eax: 2008080422 registers.ebp: 9 registers.edx: 0 registers.ebx: 64 registers.esi: 35788304 registers.ecx: 0	1
__exception__ Oct. 14, 2021, 5:17 p.m.	stacktrace: exception.instruction_r: cc c3 5d c3 33 c0 5d c3 68 e0 7d b6 c0 68 ea b3 exception.instruction: int3 exception.exception_code: 0x80000003 exception.symbol: DllRegisterServer+0x72ec c78zdj+0x1105c exception.address: 0x86105c registers.esp: 2027488 registers.edi: 6 registers.eax: 2008080422 registers.ebp: 8 registers.edx: 0 registers.ebx: 64 registers.esi: 35788328 registers.ecx: 0	1
__exception__ Oct. 14, 2021, 5:17 p.m.	stacktrace: exception.instruction_r: cc c3 5d c3 33 c0 5d c3 68 e0 7d b6 c0 68 ea b3 exception.instruction: int3 exception.exception_code: 0x80000003 exception.symbol: DllRegisterServer+0x72ec c78zdj+0x1105c exception.address: 0x86105c registers.esp: 2027488 registers.edi: 6 registers.eax: 2008080422 registers.ebp: 7 registers.edx: 0 registers.ebx: 64 registers.esi: 35788352 registers.ecx: 0	1
__exception__ Oct. 14, 2021, 5:17 p.m.	stacktrace: exception.instruction_r: cc c3 5d c3 33 c0 5d c3 68 e0 7d b6 c0 68 ea b3 exception.instruction: int3 exception.exception_code: 0x80000003 exception.symbol: DllRegisterServer+0x72ec c78zdj+0x1105c exception.address: 0x86105c registers.esp: 2027488 registers.edi: 6 registers.eax: 2008080422 registers.ebp: 6 registers.edx: 0 registers.ebx: 64 registers.esi: 35788376 registers.ecx: 0	1
__exception__ Oct. 14, 2021, 5:17 p.m.	stacktrace: exception.instruction_r: cc c3 5d c3 33 c0 5d c3 68 e0 7d b6 c0 68 ea b3 exception.instruction: int3 exception.exception_code: 0x80000003 exception.symbol: DllRegisterServer+0x72ec c78zdj+0x1105c exception.address: 0x86105c registers.esp: 2027488 registers.edi: 6 registers.eax: 2008080422 registers.ebp: 5 registers.edx: 0 registers.ebx: 64 registers.esi: 35788400 registers.ecx: 0	1
__exception__ Oct. 14, 2021, 5:17 p.m.	stacktrace: exception.instruction_r: cc c3 5d c3 33 c0 5d c3 68 e0 7d b6 c0 68 ea b3 exception.instruction: int3 exception.exception_code: 0x80000003 exception.symbol: DllRegisterServer+0x72ec c78zdj+0x1105c exception.address: 0x86105c registers.esp: 2027488 registers.edi: 6 registers.eax: 2008080422 registers.ebp: 4 registers.edx: 0 registers.ebx: 64 registers.esi: 35788424 registers.ecx: 0	1
__exception__ Oct. 14, 2021, 5:17 p.m.	stacktrace: exception.instruction_r: cc c3 5d c3 33 c0 5d c3 68 e0 7d b6 c0 68 ea b3 exception.instruction: int3 exception.exception_code: 0x80000003 exception.symbol: DllRegisterServer+0x72ec c78zdj+0x1105c exception.address: 0x86105c registers.esp: 2027488 registers.edi: 6 registers.eax: 2008080422 registers.ebp: 3 registers.edx: 0 registers.ebx: 64 registers.esi: 35788448 registers.ecx: 0	1
__exception__ Oct. 14, 2021, 5:17 p.m.	stacktrace: exception.instruction_r: cc c3 5d c3 33 c0 5d c3 68 e0 7d b6 c0 68 ea b3 exception.instruction: int3 exception.exception_code: 0x80000003 exception.symbol: DllRegisterServer+0x72ec c78zdj+0x1105c exception.address: 0x86105c registers.esp: 2027488 registers.edi: 6 registers.eax: 2008080422 registers.ebp: 2 registers.edx: 0 registers.ebx: 64 registers.esi: 35788472 registers.ecx: 0	1
__exception__ Oct. 14, 2021, 5:17 p.m.	stacktrace: exception.instruction_r: cc c3 5d c3 33 c0 5d c3 68 e0 7d b6 c0 68 ea b3 exception.instruction: int3 exception.exception_code: 0x80000003 exception.symbol: DllRegisterServer+0x72ec c78zdj+0x1105c exception.address: 0x86105c registers.esp: 2027488 registers.edi: 6 registers.eax: 2008080422 registers.ebp: 1 registers.edx: 0 registers.ebx: 64 registers.esi: 35788496 registers.ecx: 0	1
__exception__ Oct. 14, 2021, 5:17 p.m.	stacktrace: exception.instruction_r: cc c3 5d c3 33 c0 5d c3 68 e0 7d b6 c0 68 ea b3 exception.instruction: int3 exception.exception_code: 0x80000003 exception.symbol: DllRegisterServer+0x72ec c78zdj+0x1105c exception.address: 0x1ed105c registers.esp: 2682856 registers.edi: 2959200 registers.eax: 2008080422 registers.ebp: 2008154697 registers.edx: 129161 registers.ebx: 2704346981 registers.esi: 1990393856 registers.ecx: 66040	1
__exception__ Oct. 14, 2021, 5:17 p.m.	stacktrace: exception.instruction_r: cc c3 5d c3 33 c0 5d c3 68 e0 7d b6 c0 68 ea b3 exception.instruction: int3 exception.exception_code: 0x80000003 exception.symbol: DllRegisterServer+0x72ec c78zdj+0x1105c exception.address: 0x1ed105c registers.esp: 2682832 registers.edi: 16 registers.eax: 2008080422 registers.ebp: 8521680 registers.edx: 0 registers.ebx: 0 registers.esi: 64 registers.ecx: 0	1
__exception__ Oct. 14, 2021, 5:17 p.m.	stacktrace: exception.instruction_r: cc c3 5d c3 33 c0 5d c3 68 e0 7d b6 c0 68 ea b3 exception.instruction: int3 exception.exception_code: 0x80000003 exception.symbol: DllRegisterServer+0x72ec c78zdj+0x1105c exception.address: 0x1ed105c registers.esp: 2682832 registers.edi: 15 registers.eax: 2008080422 registers.ebp: 8521696 registers.edx: 0 registers.ebx: 0 registers.esi: 64 registers.ecx: 0	1
__exception__ Oct. 14, 2021, 5:17 p.m.	stacktrace: exception.instruction_r: cc c3 5d c3 33 c0 5d c3 68 e0 7d b6 c0 68 ea b3 exception.instruction: int3 exception.exception_code: 0x80000003 exception.symbol: DllRegisterServer+0x72ec c78zdj+0x1105c exception.address: 0x1ed105c registers.esp: 2682832 registers.edi: 14 registers.eax: 2008080422 registers.ebp: 8521712 registers.edx: 0 registers.ebx: 0 registers.esi: 64 registers.ecx: 0	1
__exception__ Oct. 14, 2021, 5:17 p.m.	stacktrace: exception.instruction_r: cc c3 5d c3 33 c0 5d c3 68 e0 7d b6 c0 68 ea b3 exception.instruction: int3 exception.exception_code: 0x80000003 exception.symbol: DllRegisterServer+0x72ec c78zdj+0x1105c exception.address: 0x1ed105c registers.esp: 2682832 registers.edi: 13 registers.eax: 2008080422 registers.ebp: 8521728 registers.edx: 0 registers.ebx: 0 registers.esi: 64 registers.ecx: 0	1
__exception__ Oct. 14, 2021, 5:17 p.m.	stacktrace: exception.instruction_r: cc c3 5d c3 33 c0 5d c3 68 e0 7d b6 c0 68 ea b3 exception.instruction: int3 exception.exception_code: 0x80000003 exception.symbol: DllRegisterServer+0x72ec c78zdj+0x1105c exception.address: 0x1ed105c registers.esp: 2682832 registers.edi: 12 registers.eax: 2008080422 registers.ebp: 8521744 registers.edx: 0 registers.ebx: 0 registers.esi: 64 registers.ecx: 0	1
__exception__ Oct. 14, 2021, 5:17 p.m.	stacktrace: exception.instruction_r: cc c3 5d c3 33 c0 5d c3 68 e0 7d b6 c0 68 ea b3 exception.instruction: int3 exception.exception_code: 0x80000003 exception.symbol: DllRegisterServer+0x72ec c78zdj+0x1105c exception.address: 0x1ed105c registers.esp: 2682832 registers.edi: 11 registers.eax: 2008080422 registers.ebp: 8521760 registers.edx: 0 registers.ebx: 0 registers.esi: 64 registers.ecx: 0	1
__exception__ Oct. 14, 2021, 5:17 p.m.	stacktrace: exception.instruction_r: cc c3 5d c3 33 c0 5d c3 68 e0 7d b6 c0 68 ea b3 exception.instruction: int3 exception.exception_code: 0x80000003 exception.symbol: DllRegisterServer+0x72ec c78zdj+0x1105c exception.address: 0x1ed105c registers.esp: 2682832 registers.edi: 10 registers.eax: 2008080422 registers.ebp: 8521776 registers.edx: 0 registers.ebx: 0 registers.esi: 64 registers.ecx: 0	1
__exception__ Oct. 14, 2021, 5:17 p.m.	stacktrace: exception.instruction_r: cc c3 5d c3 33 c0 5d c3 68 e0 7d b6 c0 68 ea b3 exception.instruction: int3 exception.exception_code: 0x80000003 exception.symbol: DllRegisterServer+0x72ec c78zdj+0x1105c exception.address: 0x1ed105c registers.esp: 2682832 registers.edi: 9 registers.eax: 2008080422 registers.ebp: 8521792 registers.edx: 0 registers.ebx: 0 registers.esi: 64 registers.ecx: 0	1
__exception__ Oct. 14, 2021, 5:17 p.m.	stacktrace: exception.instruction_r: cc c3 5d c3 33 c0 5d c3 68 e0 7d b6 c0 68 ea b3 exception.instruction: int3 exception.exception_code: 0x80000003 exception.symbol: DllRegisterServer+0x72ec c78zdj+0x1105c exception.address: 0x1ed105c registers.esp: 2682832 registers.edi: 8 registers.eax: 2008080422 registers.ebp: 8521808 registers.edx: 0 registers.ebx: 0 registers.esi: 64 registers.ecx: 0	1
__exception__ Oct. 14, 2021, 5:17 p.m.	stacktrace: exception.instruction_r: cc c3 5d c3 33 c0 5d c3 68 e0 7d b6 c0 68 ea b3 exception.instruction: int3 exception.exception_code: 0x80000003 exception.symbol: DllRegisterServer+0x72ec c78zdj+0x1105c exception.address: 0x1ed105c registers.esp: 2682832 registers.edi: 7 registers.eax: 2008080422 registers.ebp: 8521824 registers.edx: 0 registers.ebx: 0 registers.esi: 64 registers.ecx: 0	1
__exception__ Oct. 14, 2021, 5:17 p.m.	stacktrace: exception.instruction_r: cc c3 5d c3 33 c0 5d c3 68 e0 7d b6 c0 68 ea b3 exception.instruction: int3 exception.exception_code: 0x80000003 exception.symbol: DllRegisterServer+0x72ec c78zdj+0x1105c exception.address: 0x1ed105c registers.esp: 2682832 registers.edi: 6 registers.eax: 2008080422 registers.ebp: 8521840 registers.edx: 0 registers.ebx: 0 registers.esi: 64 registers.ecx: 0	1
__exception__ Oct. 14, 2021, 5:17 p.m.	stacktrace: exception.instruction_r: cc c3 5d c3 33 c0 5d c3 68 e0 7d b6 c0 68 ea b3 exception.instruction: int3 exception.exception_code: 0x80000003 exception.symbol: DllRegisterServer+0x72ec c78zdj+0x1105c exception.address: 0x1ed105c registers.esp: 2682832 registers.edi: 5 registers.eax: 2008080422 registers.ebp: 8521856 registers.edx: 0 registers.ebx: 0 registers.esi: 64 registers.ecx: 0	1
__exception__ Oct. 14, 2021, 5:17 p.m.	stacktrace: exception.instruction_r: cc c3 5d c3 33 c0 5d c3 68 e0 7d b6 c0 68 ea b3 exception.instruction: int3 exception.exception_code: 0x80000003 exception.symbol: DllRegisterServer+0x72ec c78zdj+0x1105c exception.address: 0x1ed105c registers.esp: 2682832 registers.edi: 4 registers.eax: 2008080422 registers.ebp: 8521872 registers.edx: 0 registers.ebx: 0 registers.esi: 64 registers.ecx: 0	1
__exception__ Oct. 14, 2021, 5:17 p.m.	stacktrace: exception.instruction_r: cc c3 5d c3 33 c0 5d c3 68 e0 7d b6 c0 68 ea b3 exception.instruction: int3 exception.exception_code: 0x80000003 exception.symbol: DllRegisterServer+0x72ec c78zdj+0x1105c exception.address: 0x1ed105c registers.esp: 2682832 registers.edi: 3 registers.eax: 2008080422 registers.ebp: 8521888 registers.edx: 0 registers.ebx: 0 registers.esi: 64 registers.ecx: 0	1

Allocates read-write-execute memory (usually to unpack itself) (18 events)

Time & API	Arguments	Status
NtProtectVirtualMemory Oct. 14, 2021, 5:17 p.m.	process_identifier: 1548 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0087d000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Oct. 14, 2021, 5:17 p.m.	process_identifier: 1548 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x73fe1000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Oct. 14, 2021, 5:17 p.m.	process_identifier: 1548 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 24576 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x008e4000 process_handle: 0xffffffff	1
NtAllocateVirtualMemory Oct. 14, 2021, 5:17 p.m.	process_identifier: 1548 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x003b0000 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Oct. 14, 2021, 5:17 p.m.	process_identifier: 1548 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x003c0000 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Oct. 14, 2021, 5:17 p.m.	process_identifier: 1548 region_size: 614400 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00ac0000 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0xffffffff	1
NtProtectVirtualMemory Oct. 14, 2021, 5:17 p.m.	process_identifier: 1772 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x01eed000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Oct. 14, 2021, 5:17 p.m.	process_identifier: 1772 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x73fe1000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Oct. 14, 2021, 5:17 p.m.	process_identifier: 1772 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 24576 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x01f54000 process_handle: 0xffffffff	1
NtAllocateVirtualMemory Oct. 14, 2021, 5:17 p.m.	process_identifier: 1772 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x007d0000 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Oct. 14, 2021, 5:17 p.m.	process_identifier: 1772 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x007e0000 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Oct. 14, 2021, 5:17 p.m.	process_identifier: 1772 region_size: 614400 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x02000000 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0xffffffff	1
NtProtectVirtualMemory Oct. 14, 2021, 5:17 p.m.	process_identifier: 688 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x004cd000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Oct. 14, 2021, 5:17 p.m.	process_identifier: 688 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x73fe1000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Oct. 14, 2021, 5:17 p.m.	process_identifier: 688 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 24576 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00534000 process_handle: 0xffffffff	1
NtAllocateVirtualMemory Oct. 14, 2021, 5:17 p.m.	process_identifier: 688 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00300000 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Oct. 14, 2021, 5:17 p.m.	process_identifier: 688 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00310000 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Oct. 14, 2021, 5:17 p.m.	process_identifier: 688 region_size: 614400 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00370000 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0xffffffff	1

File has been identified by 8 AntiVirus engines on VirusTotal as malicious (8 events)

Elastic	malicious (high confidence)
ESET-NOD32	a variant of Win32/GenKryptik.FLZQ
APEX	Malicious
Kaspersky	VHO:Trojan-Banker.Win32.Cridex.gen
DrWeb	Trojan.Dridex.735
SentinelOne	Static AI - Suspicious PE
Microsoft	Trojan:Win32/Sabsik.FL.B!ml
McAfee	GenericRXAA-AA!CB1C5D7A7E08

Communicates with host for which no DNS query was performed (1 event)

host

131.153.76.130

c78zdj.jpg

Process Tree Toggle all

Network Toggle all

Suricata Toggle all

Suricata Alerts

Suricata TLS

Signatures Toggle All