popup
Summary | ZeroBOX
  1. Home
  2. Result
  3. Report
  4. Detail Analysis

XBByNUNWvIEvawb68

Emotet Malicious Library UPX PE File DLL OS Processor Check PE32
  1. Resubmit sample
Category Machine Started Completed
FILE s1_win7_x6401 Nov. 17, 2021, 8 a.m. Nov. 17, 2021, 8:22 a.m.
Size 252.5KB
Type PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
MD5 e86945ed547f642291afcf2f5c2112a0
SHA256 a29889c967089ae02845edd0b9547ebbbc9e6fa51268a21c0ac98f994e33bfaf
CRC32 EDDB7A88
ssdeep 3072:PtgItJoMl9eJ02kGuBDhk3VsbwVBQdP6ZkiaoZa74jZUUzdDIm6O80MTcdfokHJ/:OHK9eSBFA+bwVB35tMTc5ocEFWTBjz
Yara
  • Win32_Trojan_Emotet_RL_Gen_Zero - Win32 Trojan Emotet
  • PE_Header_Zero - PE File Signature
  • OS_Processor_Check_Zero - OS Processor Check
  • IsPE32 - (no description)
  • Win32_Trojan_Emotet_RL_1_Zero - Win32 Trojan Emotet
  • IsDLL - (no description)
  • Win32_Trojan_Emotet_RL_2_Zero - Win32 Trojan Emotet
  • Malicious_Library_Zero - Malicious_Library
  • UPX_Zero - UPX packed file

Name Response Post-Analysis Lookup
No hosts contacted.
IP Address Status Action
103.75.201.2 Active Moloch
103.8.26.102 Active Moloch
103.8.26.103 Active Moloch
104.251.214.46 Active Moloch
138.185.72.26 Active Moloch
178.79.147.66 Active Moloch
185.184.25.237 Active Moloch
188.93.125.116 Active Moloch
195.154.133.20 Active Moloch
207.38.84.195 Active Moloch
210.57.217.132 Active Moloch
212.237.5.209 Active Moloch
45.118.135.203 Active Moloch
45.142.114.231 Active Moloch
45.76.176.10 Active Moloch
51.68.175.8 Active Moloch
58.227.42.236 Active Moloch
66.42.55.5 Active Moloch
81.0.236.93 Active Moloch
94.177.248.64 Active Moloch
97.83.40.67 Active Moloch

Suricata Alerts

Flow SID Signature Category
TCP 94.177.248.64:443 -> 192.168.56.101:49167 2029340 ET INFO TLS Handshake Failure Potentially Bad Traffic
TCP 103.8.26.103:8080 -> 192.168.56.101:49175 2029340 ET INFO TLS Handshake Failure Potentially Bad Traffic
TCP 192.168.56.101:49170 -> 66.42.55.5:7080 2028401 ET JA3 Hash - Possible Malware - Various Trickbot/Kovter/Dridex Unknown Traffic
TCP 192.168.56.101:49201 -> 210.57.217.132:8080 2028401 ET JA3 Hash - Possible Malware - Various Trickbot/Kovter/Dridex Unknown Traffic
TCP 192.168.56.101:49216 -> 103.8.26.103:8080 2028401 ET JA3 Hash - Possible Malware - Various Trickbot/Kovter/Dridex Unknown Traffic
TCP 192.168.56.101:49174 -> 103.8.26.103:8080 2028401 ET JA3 Hash - Possible Malware - Various Trickbot/Kovter/Dridex Unknown Traffic
TCP 192.168.56.101:49177 -> 185.184.25.237:8080 2028401 ET JA3 Hash - Possible Malware - Various Trickbot/Kovter/Dridex Unknown Traffic
TCP 192.168.56.101:49166 -> 94.177.248.64:443 2028401 ET JA3 Hash - Possible Malware - Various Trickbot/Kovter/Dridex Unknown Traffic
TCP 185.184.25.237:8080 -> 192.168.56.101:49179 2029340 ET INFO TLS Handshake Failure Potentially Bad Traffic
TCP 192.168.56.101:49184 -> 103.8.26.102:8080 2028401 ET JA3 Hash - Possible Malware - Various Trickbot/Kovter/Dridex Unknown Traffic
TCP 192.168.56.101:49197 -> 51.68.175.8:8080 2028401 ET JA3 Hash - Possible Malware - Various Trickbot/Kovter/Dridex Unknown Traffic
TCP 51.68.175.8:8080 -> 192.168.56.101:49199 2029340 ET INFO TLS Handshake Failure Potentially Bad Traffic
TCP 192.168.56.101:49187 -> 178.79.147.66:8080 2404307 ET CNC Feodo Tracker Reported CnC Server group 8 A Network Trojan was detected
TCP 192.168.56.101:49194 -> 207.38.84.195:8080 2404312 ET CNC Feodo Tracker Reported CnC Server group 13 A Network Trojan was detected
TCP 192.168.56.101:49202 -> 210.57.217.132:8080 2028401 ET JA3 Hash - Possible Malware - Various Trickbot/Kovter/Dridex Unknown Traffic
TCP 210.57.217.132:8080 -> 192.168.56.101:49203 2029340 ET INFO TLS Handshake Failure Potentially Bad Traffic
TCP 66.42.55.5:7080 -> 192.168.56.101:49171 2029340 ET INFO TLS Handshake Failure Potentially Bad Traffic
TCP 66.42.55.5:7080 -> 192.168.56.101:49214 2029340 ET INFO TLS Handshake Failure Potentially Bad Traffic
TCP 192.168.56.101:49181 -> 45.76.176.10:8080 2404316 ET CNC Feodo Tracker Reported CnC Server group 17 A Network Trojan was detected
TCP 103.8.26.103:8080 -> 192.168.56.101:49218 2029340 ET INFO TLS Handshake Failure Potentially Bad Traffic
TCP 185.184.25.237:8080 -> 192.168.56.101:49222 2029340 ET INFO TLS Handshake Failure Potentially Bad Traffic
TCP 103.8.26.102:8080 -> 192.168.56.101:49185 2029340 ET INFO TLS Handshake Failure Potentially Bad Traffic
TCP 94.177.248.64:443 -> 192.168.56.101:49210 2029340 ET INFO TLS Handshake Failure Potentially Bad Traffic
TCP 192.168.56.101:49208 -> 94.177.248.64:443 2028401 ET JA3 Hash - Possible Malware - Various Trickbot/Kovter/Dridex Unknown Traffic
TCP 192.168.56.101:49212 -> 66.42.55.5:7080 2028401 ET JA3 Hash - Possible Malware - Various Trickbot/Kovter/Dridex Unknown Traffic
TCP 192.168.56.101:49217 -> 103.8.26.103:8080 2028401 ET JA3 Hash - Possible Malware - Various Trickbot/Kovter/Dridex Unknown Traffic
TCP 192.168.56.101:49220 -> 185.184.25.237:8080 2028401 ET JA3 Hash - Possible Malware - Various Trickbot/Kovter/Dridex Unknown Traffic
TCP 192.168.56.101:49227 -> 103.8.26.102:8080 2028401 ET JA3 Hash - Possible Malware - Various Trickbot/Kovter/Dridex Unknown Traffic
TCP 192.168.56.101:49221 -> 185.184.25.237:8080 2028401 ET JA3 Hash - Possible Malware - Various Trickbot/Kovter/Dridex Unknown Traffic
TCP 192.168.56.101:49226 -> 103.8.26.102:8080 2028401 ET JA3 Hash - Possible Malware - Various Trickbot/Kovter/Dridex Unknown Traffic
TCP 103.8.26.102:8080 -> 192.168.56.101:49228 2029340 ET INFO TLS Handshake Failure Potentially Bad Traffic
TCP 192.168.56.101:49165 -> 94.177.248.64:443 2028401 ET JA3 Hash - Possible Malware - Various Trickbot/Kovter/Dridex Unknown Traffic
TCP 192.168.56.101:49169 -> 66.42.55.5:7080 2028401 ET JA3 Hash - Possible Malware - Various Trickbot/Kovter/Dridex Unknown Traffic
TCP 192.168.56.101:49173 -> 103.8.26.103:8080 2028401 ET JA3 Hash - Possible Malware - Various Trickbot/Kovter/Dridex Unknown Traffic
TCP 192.168.56.101:49178 -> 185.184.25.237:8080 2028401 ET JA3 Hash - Possible Malware - Various Trickbot/Kovter/Dridex Unknown Traffic
TCP 192.168.56.101:49183 -> 103.8.26.102:8080 2028401 ET JA3 Hash - Possible Malware - Various Trickbot/Kovter/Dridex Unknown Traffic
TCP 192.168.56.101:49198 -> 51.68.175.8:8080 2028401 ET JA3 Hash - Possible Malware - Various Trickbot/Kovter/Dridex Unknown Traffic
TCP 192.168.56.101:49209 -> 94.177.248.64:443 2028401 ET JA3 Hash - Possible Malware - Various Trickbot/Kovter/Dridex Unknown Traffic
TCP 192.168.56.101:49213 -> 66.42.55.5:7080 2028401 ET JA3 Hash - Possible Malware - Various Trickbot/Kovter/Dridex Unknown Traffic

Suricata TLS

No Suricata TLS

Time & API Arguments Status Return Repeated

GetComputerNameA

 computer_name: TEST22-PC
1 1 0
Time & API Arguments Status Return Repeated

IsDebuggerPresent

 0 0
ip 103.8.26.102
ip 103.8.26.103
ip 185.184.25.237
ip 210.57.217.132
ip 51.68.175.8
ip 66.42.55.5
Time & API Arguments Status Return Repeated

NtProtectVirtualMemory

 process_identifier: 2776
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x73e24000
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2776
region_size: 163840
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x10000000
allocation_type: 12288 (MEM_COMMIT|MEM_RESERVE)
process_handle: 0xffffffff
1 0 0

NtProtectVirtualMemory

 process_identifier: 2776
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x73d80000
process_handle: 0xffffffff
1 0 0

NtProtectVirtualMemory

 process_identifier: 2776
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x73c91000
process_handle: 0xffffffff
1 0 0

NtProtectVirtualMemory

 process_identifier: 2776
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x73c01000
process_handle: 0xffffffff
1 0 0

NtProtectVirtualMemory

 process_identifier: 2776
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x73bc4000
process_handle: 0xffffffff
1 0 0

NtProtectVirtualMemory

 process_identifier: 2776
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x73c92000
process_handle: 0xffffffff
1 0 0

NtProtectVirtualMemory

 process_identifier: 2776
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x746d1000
process_handle: 0xffffffff
1 0 0

NtProtectVirtualMemory

 process_identifier: 2776
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x742e1000
process_handle: 0xffffffff
1 0 0

NtProtectVirtualMemory

 process_identifier: 2776
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x76941000
process_handle: 0xffffffff
1 0 0

NtProtectVirtualMemory

 process_identifier: 2776
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x75291000
process_handle: 0xffffffff
1 0 0

NtProtectVirtualMemory

 process_identifier: 2776
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x750c1000
process_handle: 0xffffffff
1 0 0

NtProtectVirtualMemory

 process_identifier: 2776
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x76451000
process_handle: 0xffffffff
1 0 0

NtProtectVirtualMemory

 process_identifier: 2776
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x73e81000
process_handle: 0xffffffff
1 0 0

NtProtectVirtualMemory

 process_identifier: 2776
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x73e41000
process_handle: 0xffffffff
1 0 0
Time & API Arguments Status Return Repeated

Process32NextW

 snapshot_handle: 0x00000160
process_name: sdclt.exe
process_identifier: 2584
1 1 0

Process32NextW

 snapshot_handle: 0x00000160
process_name: SearchProtocolHost.exe
process_identifier: 2684
1 1 0

Process32NextW

 snapshot_handle: 0x00000160
process_name: rundll32.exe
process_identifier: 2776
1 1 0
section {u'size_of_data': u'0x00033000', u'virtual_address': u'0x00001000', u'entropy': 7.491479171511666, u'name': u'.text', u'virtual_size': u'0x00032f04'} entropy 7.49147917151 description A section with a high entropy has been found
entropy 0.811133200795 description Overall entropy of this PE file is high
process rundll32.exe
host 103.75.201.2
host 103.8.26.102
host 103.8.26.103
host 104.251.214.46
host 138.185.72.26
host 178.79.147.66
host 185.184.25.237
host 188.93.125.116
host 195.154.133.20
host 207.38.84.195
host 210.57.217.132
host 212.237.5.209
host 45.118.135.203
host 45.142.114.231
host 45.76.176.10
host 51.68.175.8
host 58.227.42.236
host 66.42.55.5
host 81.0.236.93
host 94.177.248.64
host 97.83.40.67
Bkav W32.AIDetect.malware2
Elastic malicious (high confidence)
FireEye Generic.mg.e86945ed547f6422
McAfee Artemis!E86945ED547F
Cylance Unsafe
BitDefenderTheta Gen:NN.ZedlaF.34266.pq4@ayh0cbo
Symantec ML.Attribute.HighConfidence
ESET-NOD32 a variant of Win32/GenKryptik.FNOE
Kaspersky VHO:Trojan-Banker.Win32.Emotet.ghbn
McAfee-GW-Edition BehavesLike.Win32.Trojan.dc
eGambit Unsafe.AI_Score_92%
APEX Malicious
Cynet Malicious (score: 100)
SentinelOne Static AI - Malicious PE
MaxSecure Trojan.Malware.300983.susgen
dead_host 192.168.56.101:49181
dead_host 192.168.56.101:49191
dead_host 192.168.56.101:49188
dead_host 192.168.56.101:49231
dead_host 192.168.56.101:49233
dead_host 192.168.56.101:49196
dead_host 45.76.176.10:8080
dead_host 195.154.133.20:443
dead_host 192.168.56.101:49193
dead_host 192.168.56.101:49224
dead_host 192.168.56.101:49234
dead_host 103.75.201.2:443
dead_host 138.185.72.26:8080
dead_host 104.251.214.46:8080
dead_host 58.227.42.236:80
dead_host 207.38.84.195:8080
dead_host 188.93.125.116:8080
dead_host 45.118.135.203:7080
dead_host 192.168.56.101:49194
dead_host 192.168.56.101:49225
dead_host 192.168.56.101:49189
dead_host 81.0.236.93:443
dead_host 45.142.114.231:8080
dead_host 178.79.147.66:8080
dead_host 192.168.56.101:49182
dead_host 192.168.56.101:49195
dead_host 192.168.56.101:49190
dead_host 192.168.56.101:49230
dead_host 192.168.56.101:49232
dead_host 192.168.56.101:49187
dead_host 212.237.5.209:443