popup
Summary | ZeroBOX
  1. Home
  2. Result
  3. Report
  4. Detail Analysis

nVgyRFrTE68Yd9s6

Emotet Malicious Library UPX PE File DLL OS Processor Check PE32
  1. Resubmit sample
Category Machine Started Completed
FILE s1_win7_x6403_us Nov. 17, 2021, 8 a.m. Nov. 17, 2021, 8:15 a.m.
Size 252.5KB
Type PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
MD5 01f5cb1e8de71d40cf1a92f46951b19c
SHA256 3acc4088984053f32850ec5b1578b94b7951613f9231fe94c67cb340ce5e13dc
CRC32 9CCA1DD8
ssdeep 3072:PtgItJoMl9eJ02kGuBDhk3VsbwVBQdP6ZkiaoZa74jZUUzdDIm6O80MTcdfokHJl:OHK9eSBFA+bwVB35tMTc5ocEFWTBdz
Yara
  • Win32_Trojan_Emotet_RL_Gen_Zero - Win32 Trojan Emotet
  • PE_Header_Zero - PE File Signature
  • OS_Processor_Check_Zero - OS Processor Check
  • IsPE32 - (no description)
  • Win32_Trojan_Emotet_RL_1_Zero - Win32 Trojan Emotet
  • IsDLL - (no description)
  • Win32_Trojan_Emotet_RL_2_Zero - Win32 Trojan Emotet
  • Malicious_Library_Zero - Malicious_Library
  • UPX_Zero - UPX packed file

Name Response Post-Analysis Lookup
No hosts contacted.
IP Address Status Action
103.75.201.2 Active Moloch
103.8.26.102 Active Moloch
103.8.26.103 Active Moloch
104.251.214.46 Active Moloch
138.185.72.26 Active Moloch
178.79.147.66 Active Moloch
185.184.25.237 Active Moloch
188.93.125.116 Active Moloch
195.154.133.20 Active Moloch
207.38.84.195 Active Moloch
210.57.217.132 Active Moloch
212.237.5.209 Active Moloch
45.118.135.203 Active Moloch
45.142.114.231 Active Moloch
45.76.176.10 Active Moloch
51.68.175.8 Active Moloch
58.227.42.236 Active Moloch
66.42.55.5 Active Moloch
81.0.236.93 Active Moloch
94.177.248.64 Active Moloch

Suricata Alerts

Flow SID Signature Category
TCP 94.177.248.64:443 -> 192.168.56.103:49166 2029340 ET INFO TLS Handshake Failure Potentially Bad Traffic
TCP 192.168.56.103:49165 -> 94.177.248.64:443 2028401 ET JA3 Hash - Possible Malware - Various Trickbot/Kovter/Dridex Unknown Traffic
TCP 103.8.26.103:8080 -> 192.168.56.103:49174 2029340 ET INFO TLS Handshake Failure Potentially Bad Traffic
TCP 192.168.56.103:49168 -> 66.42.55.5:7080 2028401 ET JA3 Hash - Possible Malware - Various Trickbot/Kovter/Dridex Unknown Traffic
TCP 103.8.26.102:8080 -> 192.168.56.103:49184 2029340 ET INFO TLS Handshake Failure Potentially Bad Traffic
TCP 192.168.56.103:49169 -> 66.42.55.5:7080 2028401 ET JA3 Hash - Possible Malware - Various Trickbot/Kovter/Dridex Unknown Traffic
TCP 192.168.56.103:49197 -> 51.68.175.8:8080 2028401 ET JA3 Hash - Possible Malware - Various Trickbot/Kovter/Dridex Unknown Traffic
TCP 66.42.55.5:7080 -> 192.168.56.103:49170 2029340 ET INFO TLS Handshake Failure Potentially Bad Traffic
TCP 192.168.56.103:49177 -> 185.184.25.237:8080 2028401 ET JA3 Hash - Possible Malware - Various Trickbot/Kovter/Dridex Unknown Traffic
TCP 192.168.56.103:49214 -> 103.8.26.103:8080 2028401 ET JA3 Hash - Possible Malware - Various Trickbot/Kovter/Dridex Unknown Traffic
TCP 185.184.25.237:8080 -> 192.168.56.103:49178 2029340 ET INFO TLS Handshake Failure Potentially Bad Traffic
TCP 192.168.56.103:49218 -> 185.184.25.237:8080 2028401 ET JA3 Hash - Possible Malware - Various Trickbot/Kovter/Dridex Unknown Traffic
TCP 185.184.25.237:8080 -> 192.168.56.103:49219 2029340 ET INFO TLS Handshake Failure Potentially Bad Traffic
TCP 192.168.56.103:49196 -> 51.68.175.8:8080 2028401 ET JA3 Hash - Possible Malware - Various Trickbot/Kovter/Dridex Unknown Traffic
TCP 192.168.56.103:49172 -> 103.8.26.103:8080 2028401 ET JA3 Hash - Possible Malware - Various Trickbot/Kovter/Dridex Unknown Traffic
TCP 192.168.56.103:49200 -> 210.57.217.132:8080 2028401 ET JA3 Hash - Possible Malware - Various Trickbot/Kovter/Dridex Unknown Traffic
TCP 192.168.56.103:49186 -> 178.79.147.66:8080 2404307 ET CNC Feodo Tracker Reported CnC Server group 8 A Network Trojan was detected
TCP 192.168.56.103:49193 -> 207.38.84.195:8080 2404312 ET CNC Feodo Tracker Reported CnC Server group 13 A Network Trojan was detected
TCP 192.168.56.103:49164 -> 94.177.248.64:443 2028401 ET JA3 Hash - Possible Malware - Various Trickbot/Kovter/Dridex Unknown Traffic
TCP 103.8.26.102:8080 -> 192.168.56.103:49225 2029340 ET INFO TLS Handshake Failure Potentially Bad Traffic
TCP 192.168.56.103:49182 -> 103.8.26.102:8080 2028401 ET JA3 Hash - Possible Malware - Various Trickbot/Kovter/Dridex Unknown Traffic
TCP 192.168.56.103:49173 -> 103.8.26.103:8080 2028401 ET JA3 Hash - Possible Malware - Various Trickbot/Kovter/Dridex Unknown Traffic
TCP 192.168.56.103:49176 -> 185.184.25.237:8080 2028401 ET JA3 Hash - Possible Malware - Various Trickbot/Kovter/Dridex Unknown Traffic
TCP 192.168.56.103:49180 -> 45.76.176.10:8080 2404316 ET CNC Feodo Tracker Reported CnC Server group 17 A Network Trojan was detected
TCP 51.68.175.8:8080 -> 192.168.56.103:49198 2029340 ET INFO TLS Handshake Failure Potentially Bad Traffic
TCP 192.168.56.103:49183 -> 103.8.26.102:8080 2028401 ET JA3 Hash - Possible Malware - Various Trickbot/Kovter/Dridex Unknown Traffic
TCP 192.168.56.103:49201 -> 210.57.217.132:8080 2028401 ET JA3 Hash - Possible Malware - Various Trickbot/Kovter/Dridex Unknown Traffic
TCP 210.57.217.132:8080 -> 192.168.56.103:49202 2029340 ET INFO TLS Handshake Failure Potentially Bad Traffic
TCP 94.177.248.64:443 -> 192.168.56.103:49207 2029340 ET INFO TLS Handshake Failure Potentially Bad Traffic
TCP 192.168.56.103:49205 -> 94.177.248.64:443 2028401 ET JA3 Hash - Possible Malware - Various Trickbot/Kovter/Dridex Unknown Traffic
TCP 192.168.56.103:49209 -> 66.42.55.5:7080 2028401 ET JA3 Hash - Possible Malware - Various Trickbot/Kovter/Dridex Unknown Traffic
TCP 192.168.56.103:49206 -> 94.177.248.64:443 2028401 ET JA3 Hash - Possible Malware - Various Trickbot/Kovter/Dridex Unknown Traffic
TCP 66.42.55.5:7080 -> 192.168.56.103:49211 2029340 ET INFO TLS Handshake Failure Potentially Bad Traffic
TCP 192.168.56.103:49210 -> 66.42.55.5:7080 2028401 ET JA3 Hash - Possible Malware - Various Trickbot/Kovter/Dridex Unknown Traffic
TCP 103.8.26.103:8080 -> 192.168.56.103:49215 2029340 ET INFO TLS Handshake Failure Potentially Bad Traffic
TCP 192.168.56.103:49224 -> 103.8.26.102:8080 2028401 ET JA3 Hash - Possible Malware - Various Trickbot/Kovter/Dridex Unknown Traffic
TCP 192.168.56.103:49223 -> 103.8.26.102:8080 2028401 ET JA3 Hash - Possible Malware - Various Trickbot/Kovter/Dridex Unknown Traffic
TCP 192.168.56.103:49213 -> 103.8.26.103:8080 2028401 ET JA3 Hash - Possible Malware - Various Trickbot/Kovter/Dridex Unknown Traffic
TCP 192.168.56.103:49217 -> 185.184.25.237:8080 2028401 ET JA3 Hash - Possible Malware - Various Trickbot/Kovter/Dridex Unknown Traffic

Suricata TLS

No Suricata TLS

Time & API Arguments Status Return Repeated

GetComputerNameA

 computer_name: TEST22-PC
1 1 0
Time & API Arguments Status Return Repeated

IsDebuggerPresent

 0 0
ip 103.8.26.102
ip 103.8.26.103
ip 185.184.25.237
ip 210.57.217.132
ip 51.68.175.8
ip 66.42.55.5
Time & API Arguments Status Return Repeated

NtProtectVirtualMemory

 process_identifier: 2312
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x73eb4000
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2312
region_size: 163840
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x10000000
allocation_type: 12288 (MEM_COMMIT|MEM_RESERVE)
process_handle: 0xffffffff
1 0 0

NtProtectVirtualMemory

 process_identifier: 2312
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x73e10000
process_handle: 0xffffffff
1 0 0

NtProtectVirtualMemory

 process_identifier: 2312
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x73f01000
process_handle: 0xffffffff
1 0 0

NtProtectVirtualMemory

 process_identifier: 2312
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x73ee1000
process_handle: 0xffffffff
1 0 0

NtProtectVirtualMemory

 process_identifier: 2312
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x74bc1000
process_handle: 0xffffffff
1 0 0

NtProtectVirtualMemory

 process_identifier: 2312
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x76741000
process_handle: 0xffffffff
1 0 0

NtProtectVirtualMemory

 process_identifier: 2312
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x74fd1000
process_handle: 0xffffffff
1 0 0

NtProtectVirtualMemory

 process_identifier: 2312
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x75981000
process_handle: 0xffffffff
1 0 0

NtProtectVirtualMemory

 process_identifier: 2312
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x74271000
process_handle: 0xffffffff
1 0 0

NtProtectVirtualMemory

 process_identifier: 2312
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x73dc1000
process_handle: 0xffffffff
1 0 0
Time & API Arguments Status Return Repeated

Process32NextW

 snapshot_handle: 0x00000158
process_name: mobsync.exe
process_identifier: 2016
1 1 0

Process32NextW

 snapshot_handle: 0x00000158
process_name: pw.exe
process_identifier: 2080
1 1 0

Process32NextW

 snapshot_handle: 0x00000158
process_name: taskhost.exe
process_identifier: 2104
1 1 0

Process32NextW

 snapshot_handle: 0x00000158
process_name: wsqmcons.exe
process_identifier: 2120
1 1 0

Process32NextW

 snapshot_handle: 0x00000158
process_name: sdclt.exe
process_identifier: 2128
1 1 0

Process32NextW

 snapshot_handle: 0x00000158
process_name: cmd.exe
process_identifier: 2240
1 1 0

Process32NextW

 snapshot_handle: 0x00000158
process_name: conhost.exe
process_identifier: 2248
1 1 0

Process32NextW

 snapshot_handle: 0x00000158
process_name: rundll32.exe
process_identifier: 2312
1 1 0
section {u'size_of_data': u'0x00033000', u'virtual_address': u'0x00001000', u'entropy': 7.491479171511666, u'name': u'.text', u'virtual_size': u'0x00032f04'} entropy 7.49147917151 description A section with a high entropy has been found
entropy 0.811133200795 description Overall entropy of this PE file is high
process rundll32.exe
host 103.75.201.2
host 103.8.26.102
host 103.8.26.103
host 104.251.214.46
host 138.185.72.26
host 178.79.147.66
host 185.184.25.237
host 188.93.125.116
host 195.154.133.20
host 207.38.84.195
host 210.57.217.132
host 212.237.5.209
host 45.118.135.203
host 45.142.114.231
host 45.76.176.10
host 51.68.175.8
host 58.227.42.236
host 66.42.55.5
host 81.0.236.93
host 94.177.248.64
dead_host 192.168.56.103:49193
dead_host 103.75.201.2:443
dead_host 192.168.56.103:49181
dead_host 192.168.56.103:49190
dead_host 192.168.56.103:49186
dead_host 192.168.56.103:49229
dead_host 45.76.176.10:8080
dead_host 195.154.133.20:443
dead_host 192.168.56.103:49222
dead_host 192.168.56.103:49194
dead_host 138.185.72.26:8080
dead_host 192.168.56.103:49187
dead_host 104.251.214.46:8080
dead_host 58.227.42.236:80
dead_host 207.38.84.195:8080
dead_host 188.93.125.116:8080
dead_host 192.168.56.103:49230
dead_host 45.118.135.203:7080
dead_host 192.168.56.103:49188
dead_host 192.168.56.103:49195
dead_host 81.0.236.93:443
dead_host 45.142.114.231:8080
dead_host 178.79.147.66:8080
dead_host 192.168.56.103:49231
dead_host 192.168.56.103:49189
dead_host 192.168.56.103:49192
dead_host 192.168.56.103:49227
dead_host 192.168.56.103:49180
dead_host 212.237.5.209:443
dead_host 192.168.56.103:49228
dead_host 192.168.56.103:49221