popup
Summary | ZeroBOX
  1. Home
  2. Result
  3. Report
  4. Detail Analysis

a

Emotet Malicious Library UPX PE File DLL OS Processor Check PE32
  1. Resubmit sample
Category Machine Started Completed
FILE s1_win7_x6401 Nov. 17, 2021, 7:55 a.m. Nov. 17, 2021, 8:09 a.m.
Size 252.5KB
Type PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
MD5 4e5a57bf7816af85829a14bae48168f8
SHA256 8d4bb9d825f94b2bbccb035c535ca52b0a7819ea0f24f2e02aa0624f2d0c8bc0
CRC32 89DEFC04
ssdeep 3072:PtgItJoMl9eJ02kGuBDhk3VsbwVBQdP6ZkiaoZa74jZUUzdDIm6O80MTcdfokHJU:OHK9eSBFA+bwVB35tMTc5ocEFWTBMz
Yara
  • Win32_Trojan_Emotet_RL_Gen_Zero - Win32 Trojan Emotet
  • PE_Header_Zero - PE File Signature
  • OS_Processor_Check_Zero - OS Processor Check
  • IsPE32 - (no description)
  • Win32_Trojan_Emotet_RL_1_Zero - Win32 Trojan Emotet
  • IsDLL - (no description)
  • Win32_Trojan_Emotet_RL_2_Zero - Win32 Trojan Emotet
  • Malicious_Library_Zero - Malicious_Library
  • UPX_Zero - UPX packed file

Name Response Post-Analysis Lookup
No hosts contacted.
IP Address Status Action
103.8.26.102 Active Moloch
103.75.201.2 Active Moloch
103.8.26.103 Active Moloch
104.251.214.46 Active Moloch
138.185.72.26 Active Moloch
178.79.147.66 Active Moloch
185.184.25.237 Active Moloch
188.93.125.116 Active Moloch
195.154.133.20 Active Moloch
207.38.84.195 Active Moloch
210.57.217.132 Active Moloch
212.237.5.209 Active Moloch
45.118.135.203 Active Moloch
45.142.114.231 Active Moloch
45.76.176.10 Active Moloch
51.68.175.8 Active Moloch
58.227.42.236 Active Moloch
66.42.55.5 Active Moloch
81.0.236.93 Active Moloch
94.177.248.64 Active Moloch

Suricata Alerts

Flow SID Signature Category
TCP 192.168.56.101:49171 -> 66.42.55.5:7080 2028401 ET JA3 Hash - Possible Malware - Various Trickbot/Kovter/Dridex Unknown Traffic
TCP 192.168.56.101:49174 -> 103.8.26.103:8080 2028401 ET JA3 Hash - Possible Malware - Various Trickbot/Kovter/Dridex Unknown Traffic
TCP 66.42.55.5:7080 -> 192.168.56.101:49172 2029340 ET INFO TLS Handshake Failure Potentially Bad Traffic
TCP 192.168.56.101:49170 -> 66.42.55.5:7080 2028401 ET JA3 Hash - Possible Malware - Various Trickbot/Kovter/Dridex Unknown Traffic
TCP 103.8.26.103:8080 -> 192.168.56.101:49176 2029340 ET INFO TLS Handshake Failure Potentially Bad Traffic
TCP 192.168.56.101:49182 -> 45.76.176.10:8080 2404316 ET CNC Feodo Tracker Reported CnC Server group 17 A Network Trojan was detected
TCP 51.68.175.8:8080 -> 192.168.56.101:49200 2029340 ET INFO TLS Handshake Failure Potentially Bad Traffic
TCP 192.168.56.101:49178 -> 185.184.25.237:8080 2028401 ET JA3 Hash - Possible Malware - Various Trickbot/Kovter/Dridex Unknown Traffic
TCP 192.168.56.101:49184 -> 103.8.26.102:8080 2028401 ET JA3 Hash - Possible Malware - Various Trickbot/Kovter/Dridex Unknown Traffic
TCP 192.168.56.101:49179 -> 185.184.25.237:8080 2028401 ET JA3 Hash - Possible Malware - Various Trickbot/Kovter/Dridex Unknown Traffic
TCP 192.168.56.101:49211 -> 66.42.55.5:7080 2028401 ET JA3 Hash - Possible Malware - Various Trickbot/Kovter/Dridex Unknown Traffic
TCP 192.168.56.101:49188 -> 178.79.147.66:8080 2404307 ET CNC Feodo Tracker Reported CnC Server group 8 A Network Trojan was detected
TCP 192.168.56.101:49198 -> 51.68.175.8:8080 2028401 ET JA3 Hash - Possible Malware - Various Trickbot/Kovter/Dridex Unknown Traffic
TCP 192.168.56.101:49226 -> 103.8.26.102:8080 2028401 ET JA3 Hash - Possible Malware - Various Trickbot/Kovter/Dridex Unknown Traffic
TCP 210.57.217.132:8080 -> 192.168.56.101:49204 2029340 ET INFO TLS Handshake Failure Potentially Bad Traffic
TCP 94.177.248.64:443 -> 192.168.56.101:49168 2029340 ET INFO TLS Handshake Failure Potentially Bad Traffic
TCP 192.168.56.101:49207 -> 94.177.248.64:443 2028401 ET JA3 Hash - Possible Malware - Various Trickbot/Kovter/Dridex Unknown Traffic
TCP 192.168.56.101:49175 -> 103.8.26.103:8080 2028401 ET JA3 Hash - Possible Malware - Various Trickbot/Kovter/Dridex Unknown Traffic
TCP 94.177.248.64:443 -> 192.168.56.101:49209 2029340 ET INFO TLS Handshake Failure Potentially Bad Traffic
TCP 192.168.56.101:49199 -> 51.68.175.8:8080 2028401 ET JA3 Hash - Possible Malware - Various Trickbot/Kovter/Dridex Unknown Traffic
TCP 192.168.56.101:49203 -> 210.57.217.132:8080 2028401 ET JA3 Hash - Possible Malware - Various Trickbot/Kovter/Dridex Unknown Traffic
TCP 192.168.56.101:49225 -> 103.8.26.102:8080 2028401 ET JA3 Hash - Possible Malware - Various Trickbot/Kovter/Dridex Unknown Traffic
TCP 192.168.56.101:49215 -> 103.8.26.103:8080 2028401 ET JA3 Hash - Possible Malware - Various Trickbot/Kovter/Dridex Unknown Traffic
TCP 103.8.26.103:8080 -> 192.168.56.101:49217 2029340 ET INFO TLS Handshake Failure Potentially Bad Traffic
TCP 192.168.56.101:49219 -> 185.184.25.237:8080 2028401 ET JA3 Hash - Possible Malware - Various Trickbot/Kovter/Dridex Unknown Traffic
TCP 192.168.56.101:49220 -> 185.184.25.237:8080 2028401 ET JA3 Hash - Possible Malware - Various Trickbot/Kovter/Dridex Unknown Traffic
TCP 103.8.26.102:8080 -> 192.168.56.101:49227 2029340 ET INFO TLS Handshake Failure Potentially Bad Traffic
TCP 192.168.56.101:49166 -> 94.177.248.64:443 2028401 ET JA3 Hash - Possible Malware - Various Trickbot/Kovter/Dridex Unknown Traffic
TCP 185.184.25.237:8080 -> 192.168.56.101:49180 2029340 ET INFO TLS Handshake Failure Potentially Bad Traffic
TCP 103.8.26.102:8080 -> 192.168.56.101:49186 2029340 ET INFO TLS Handshake Failure Potentially Bad Traffic
TCP 192.168.56.101:49167 -> 94.177.248.64:443 2028401 ET JA3 Hash - Possible Malware - Various Trickbot/Kovter/Dridex Unknown Traffic
TCP 192.168.56.101:49195 -> 207.38.84.195:8080 2404312 ET CNC Feodo Tracker Reported CnC Server group 13 A Network Trojan was detected
TCP 192.168.56.101:49208 -> 94.177.248.64:443 2028401 ET JA3 Hash - Possible Malware - Various Trickbot/Kovter/Dridex Unknown Traffic
TCP 192.168.56.101:49185 -> 103.8.26.102:8080 2028401 ET JA3 Hash - Possible Malware - Various Trickbot/Kovter/Dridex Unknown Traffic
TCP 192.168.56.101:49212 -> 66.42.55.5:7080 2028401 ET JA3 Hash - Possible Malware - Various Trickbot/Kovter/Dridex Unknown Traffic
TCP 66.42.55.5:7080 -> 192.168.56.101:49213 2029340 ET INFO TLS Handshake Failure Potentially Bad Traffic
TCP 192.168.56.101:49202 -> 210.57.217.132:8080 2028401 ET JA3 Hash - Possible Malware - Various Trickbot/Kovter/Dridex Unknown Traffic
TCP 192.168.56.101:49216 -> 103.8.26.103:8080 2028401 ET JA3 Hash - Possible Malware - Various Trickbot/Kovter/Dridex Unknown Traffic
TCP 185.184.25.237:8080 -> 192.168.56.101:49221 2029340 ET INFO TLS Handshake Failure Potentially Bad Traffic

Suricata TLS

No Suricata TLS

Time & API Arguments Status Return Repeated

GetComputerNameA

 computer_name: TEST22-PC
1 1 0
Time & API Arguments Status Return Repeated

IsDebuggerPresent

 0 0
ip 103.8.26.102
ip 103.8.26.103
ip 185.184.25.237
ip 210.57.217.132
ip 51.68.175.8
ip 66.42.55.5
Time & API Arguments Status Return Repeated

NtProtectVirtualMemory

 process_identifier: 2796
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x73e24000
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2796
region_size: 163840
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x10000000
allocation_type: 12288 (MEM_COMMIT|MEM_RESERVE)
process_handle: 0xffffffff
1 0 0

NtProtectVirtualMemory

 process_identifier: 2796
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x73d80000
process_handle: 0xffffffff
1 0 0

NtProtectVirtualMemory

 process_identifier: 2796
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x73c91000
process_handle: 0xffffffff
1 0 0

NtProtectVirtualMemory

 process_identifier: 2796
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x73c01000
process_handle: 0xffffffff
1 0 0

NtProtectVirtualMemory

 process_identifier: 2796
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x73bc4000
process_handle: 0xffffffff
1 0 0

NtProtectVirtualMemory

 process_identifier: 2796
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x73c92000
process_handle: 0xffffffff
1 0 0

NtProtectVirtualMemory

 process_identifier: 2796
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x746d1000
process_handle: 0xffffffff
1 0 0

NtProtectVirtualMemory

 process_identifier: 2796
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x742e1000
process_handle: 0xffffffff
1 0 0

NtProtectVirtualMemory

 process_identifier: 2796
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x76941000
process_handle: 0xffffffff
1 0 0

NtProtectVirtualMemory

 process_identifier: 2796
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x75291000
process_handle: 0xffffffff
1 0 0

NtProtectVirtualMemory

 process_identifier: 2796
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x750c1000
process_handle: 0xffffffff
1 0 0

NtProtectVirtualMemory

 process_identifier: 2796
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x76451000
process_handle: 0xffffffff
1 0 0

NtProtectVirtualMemory

 process_identifier: 2796
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x73e81000
process_handle: 0xffffffff
1 0 0

NtProtectVirtualMemory

 process_identifier: 2796
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x73e41000
process_handle: 0xffffffff
1 0 0
Time & API Arguments Status Return Repeated

Process32NextW

 snapshot_handle: 0x00000160
process_name: wsqmcons.exe
process_identifier: 2552
1 1 0

Process32NextW

 snapshot_handle: 0x00000160
process_name: sdclt.exe
process_identifier: 2576
1 1 0

Process32NextW

 snapshot_handle: 0x00000160
process_name: taskhost.exe
process_identifier: 2608
1 1 0

Process32NextW

 snapshot_handle: 0x00000160
process_name: SearchProtocolHost.exe
process_identifier: 2700
1 1 0

Process32NextW

 snapshot_handle: 0x00000160
process_name: rundll32.exe
process_identifier: 2796
1 1 0
section {u'size_of_data': u'0x00033000', u'virtual_address': u'0x00001000', u'entropy': 7.491479171511666, u'name': u'.text', u'virtual_size': u'0x00032f04'} entropy 7.49147917151 description A section with a high entropy has been found
entropy 0.811133200795 description Overall entropy of this PE file is high
process rundll32.exe
host 103.8.26.102
host 103.75.201.2
host 103.8.26.103
host 104.251.214.46
host 138.185.72.26
host 178.79.147.66
host 185.184.25.237
host 188.93.125.116
host 195.154.133.20
host 207.38.84.195
host 210.57.217.132
host 212.237.5.209
host 45.118.135.203
host 45.142.114.231
host 45.76.176.10
host 51.68.175.8
host 58.227.42.236
host 66.42.55.5
host 81.0.236.93
host 94.177.248.64
Bkav W32.AIDetect.malware2
Elastic malicious (high confidence)
MicroWorld-eScan Trojan.Agent.FPUS
FireEye Generic.mg.4e5a57bf7816af85
McAfee GenericRXAA-AA!4E5A57BF7816
Cylance Unsafe
K7GW Trojan ( 0058a7931 )
K7AntiVirus Trojan ( 0058a7931 )
Symantec ML.Attribute.HighConfidence
ESET-NOD32 a variant of Win32/Kryptik.HNIM
APEX Malicious
ClamAV Win.Malware.Generic-9909860-0
Kaspersky Trojan-Banker.Win32.Emotet.ghbn
BitDefender Trojan.Agent.FPUS
Ad-Aware Trojan.Agent.FPUS
McAfee-GW-Edition BehavesLike.Win32.Trojan.dc
SentinelOne Static AI - Malicious PE
eGambit Unsafe.AI_Score_92%
Microsoft Trojan:Win32/Wacatac.B!ml
GData Trojan.Agent.FPUS
Cynet Malicious (score: 100)
BitDefenderTheta Gen:NN.ZedlaF.34266.pq4@ayh0cbo
ALYac Trojan.Agent.Emotet
MAX malware (ai score=88)
MaxSecure Trojan.Malware.300983.susgen
Fortinet W32/Emote.CQ!tr
Panda Trj/GdSda.A
dead_host 192.168.56.101:49191
dead_host 103.75.201.2:443
dead_host 192.168.56.101:49192
dead_host 192.168.56.101:49231
dead_host 192.168.56.101:49233
dead_host 192.168.56.101:49196
dead_host 45.76.176.10:8080
dead_host 195.154.133.20:443
dead_host 192.168.56.101:49223
dead_host 192.168.56.101:49224
dead_host 192.168.56.101:49188
dead_host 138.185.72.26:8080
dead_host 192.168.56.101:49197
dead_host 104.251.214.46:8080
dead_host 58.227.42.236:80
dead_host 207.38.84.195:8080
dead_host 188.93.125.116:8080
dead_host 45.118.135.203:7080
dead_host 192.168.56.101:49194
dead_host 192.168.56.101:49189
dead_host 81.0.236.93:443
dead_host 192.168.56.101:49229
dead_host 212.237.5.209:443
dead_host 45.142.114.231:8080
dead_host 178.79.147.66:8080
dead_host 192.168.56.101:49182
dead_host 192.168.56.101:49195
dead_host 192.168.56.101:49190
dead_host 192.168.56.101:49230
dead_host 192.168.56.101:49232
dead_host 192.168.56.101:49183