popup
Summary | ZeroBOX
  1. Home
  2. Result
  3. Report
  4. Detail Analysis

F9le301G89W0s2g4jLO5

Emotet Malicious Library UPX PE File DLL OS Processor Check PE32
  1. Resubmit sample
Category Machine Started Completed
FILE s1_win7_x6403_us Nov. 18, 2021, 7:43 a.m. Nov. 18, 2021, 7:45 a.m.
Size 252.5KB
Type PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
MD5 0b4d015c501a2e0ae188e475a33fcbc1
SHA256 55c6d3a412f0ba0d860e48c4a5758f9b3a2d44d5b41cba05919666a9315360db
CRC32 E5A84B3E
ssdeep 6144:M1QMyNKCAdudRtiVNC+aFMTu90Y7TCWTBqSSC:M1OsrPNyFMTQuWTj
Yara
  • Win32_Trojan_Emotet_RL_Gen_Zero - Win32 Trojan Emotet
  • PE_Header_Zero - PE File Signature
  • OS_Processor_Check_Zero - OS Processor Check
  • IsPE32 - (no description)
  • Win32_Trojan_Emotet_RL_1_Zero - Win32 Trojan Emotet
  • IsDLL - (no description)
  • Win32_Trojan_Emotet_RL_2_Zero - Win32 Trojan Emotet
  • Malicious_Library_Zero - Malicious_Library
  • UPX_Zero - UPX packed file

Name Response Post-Analysis Lookup
No hosts contacted.
IP Address Status Action
142.4.219.173 Active Moloch
168.197.250.14 Active Moloch
177.72.80.14 Active Moloch
185.148.169.10 Active Moloch
191.252.103.16 Active Moloch
195.154.146.35 Active Moloch
195.77.239.39 Active Moloch
196.44.98.190 Active Moloch
207.148.81.119 Active Moloch
37.44.244.177 Active Moloch
37.59.209.141 Active Moloch
45.79.33.48 Active Moloch
51.178.61.60 Active Moloch
51.210.242.234 Active Moloch
54.37.228.122 Active Moloch
54.38.242.185 Active Moloch
66.42.57.149 Active Moloch
78.46.73.125 Active Moloch
78.47.204.80 Active Moloch
85.214.67.203 Active Moloch

Suricata Alerts

Flow SID Signature Category
TCP 192.168.56.103:49165 -> 51.178.61.60:443 2404317 ET CNC Feodo Tracker Reported CnC Server group 18 A Network Trojan was detected
TCP 192.168.56.103:49172 -> 45.79.33.48:8080 2404316 ET CNC Feodo Tracker Reported CnC Server group 17 A Network Trojan was detected
TCP 51.178.61.60:443 -> 192.168.56.103:49165 2029340 ET INFO TLS Handshake Failure Potentially Bad Traffic
TCP 192.168.56.103:49163 -> 51.178.61.60:443 2028401 ET JA3 Hash - Possible Malware - Various Trickbot/Kovter/Dridex Unknown Traffic
TCP 192.168.56.103:49172 -> 45.79.33.48:8080 2028401 ET JA3 Hash - Possible Malware - Various Trickbot/Kovter/Dridex Unknown Traffic
TCP 45.79.33.48:8080 -> 192.168.56.103:49173 2029340 ET INFO TLS Handshake Failure Potentially Bad Traffic
TCP 192.168.56.103:49176 -> 196.44.98.190:8080 2028401 ET JA3 Hash - Possible Malware - Various Trickbot/Kovter/Dridex Unknown Traffic
TCP 192.168.56.103:49175 -> 196.44.98.190:8080 2028401 ET JA3 Hash - Possible Malware - Various Trickbot/Kovter/Dridex Unknown Traffic
TCP 192.168.56.103:49190 -> 142.4.219.173:8080 2404304 ET CNC Feodo Tracker Reported CnC Server group 5 A Network Trojan was detected
TCP 177.72.80.14:7080 -> 192.168.56.103:49181 2029340 ET INFO TLS Handshake Failure Potentially Bad Traffic
TCP 192.168.56.103:49183 -> 51.210.242.234:8080 2028401 ET JA3 Hash - Possible Malware - Various Trickbot/Kovter/Dridex Unknown Traffic
TCP 142.4.219.173:8080 -> 192.168.56.103:49190 2029340 ET INFO TLS Handshake Failure Potentially Bad Traffic
TCP 192.168.56.103:49184 -> 51.210.242.234:8080 2028401 ET JA3 Hash - Possible Malware - Various Trickbot/Kovter/Dridex Unknown Traffic
TCP 192.168.56.103:49189 -> 142.4.219.173:8080 2028401 ET JA3 Hash - Possible Malware - Various Trickbot/Kovter/Dridex Unknown Traffic
TCP 192.168.56.103:49200 -> 207.148.81.119:8080 2404312 ET CNC Feodo Tracker Reported CnC Server group 13 A Network Trojan was detected
TCP 192.168.56.103:49220 -> 177.72.80.14:7080 2028401 ET JA3 Hash - Possible Malware - Various Trickbot/Kovter/Dridex Unknown Traffic
TCP 192.168.56.103:49204 -> 51.178.61.60:443 2028401 ET JA3 Hash - Possible Malware - Various Trickbot/Kovter/Dridex Unknown Traffic
TCP 192.168.56.103:49205 -> 51.178.61.60:443 2028401 ET JA3 Hash - Possible Malware - Various Trickbot/Kovter/Dridex Unknown Traffic
TCP 192.168.56.103:49209 -> 168.197.250.14:80 2028401 ET JA3 Hash - Possible Malware - Various Trickbot/Kovter/Dridex Unknown Traffic
TCP 192.168.56.103:49217 -> 196.44.98.190:8080 2028401 ET JA3 Hash - Possible Malware - Various Trickbot/Kovter/Dridex Unknown Traffic
TCP 192.168.56.103:49213 -> 45.79.33.48:8080 2028401 ET JA3 Hash - Possible Malware - Various Trickbot/Kovter/Dridex Unknown Traffic
TCP 196.44.98.190:8080 -> 192.168.56.103:49218 2029340 ET INFO TLS Handshake Failure Potentially Bad Traffic
TCP 192.168.56.103:49216 -> 196.44.98.190:8080 2028401 ET JA3 Hash - Possible Malware - Various Trickbot/Kovter/Dridex Unknown Traffic
TCP 192.168.56.103:49229 -> 142.4.219.173:8080 2028401 ET JA3 Hash - Possible Malware - Various Trickbot/Kovter/Dridex Unknown Traffic
TCP 51.210.242.234:8080 -> 192.168.56.103:49226 2029340 ET INFO TLS Handshake Failure Potentially Bad Traffic
TCP 192.168.56.103:49230 -> 142.4.219.173:8080 2028401 ET JA3 Hash - Possible Malware - Various Trickbot/Kovter/Dridex Unknown Traffic
TCP 192.168.56.103:49208 -> 168.197.250.14:80 2028401 ET JA3 Hash - Possible Malware - Various Trickbot/Kovter/Dridex Unknown Traffic
TCP 192.168.56.103:49212 -> 45.79.33.48:8080 2028401 ET JA3 Hash - Possible Malware - Various Trickbot/Kovter/Dridex Unknown Traffic
TCP 192.168.56.103:49224 -> 51.210.242.234:8080 2028401 ET JA3 Hash - Possible Malware - Various Trickbot/Kovter/Dridex Unknown Traffic
TCP 192.168.56.103:49167 -> 168.197.250.14:80 2028401 ET JA3 Hash - Possible Malware - Various Trickbot/Kovter/Dridex Unknown Traffic
TCP 192.168.56.103:49168 -> 168.197.250.14:80 2028401 ET JA3 Hash - Possible Malware - Various Trickbot/Kovter/Dridex Unknown Traffic
TCP 168.197.250.14:80 -> 192.168.56.103:49169 2029340 ET INFO TLS Handshake Failure Potentially Bad Traffic
TCP 192.168.56.103:49171 -> 45.79.33.48:8080 2028401 ET JA3 Hash - Possible Malware - Various Trickbot/Kovter/Dridex Unknown Traffic
TCP 196.44.98.190:8080 -> 192.168.56.103:49177 2029340 ET INFO TLS Handshake Failure Potentially Bad Traffic
TCP 192.168.56.103:49179 -> 177.72.80.14:7080 2028401 ET JA3 Hash - Possible Malware - Various Trickbot/Kovter/Dridex Unknown Traffic
TCP 51.178.61.60:443 -> 192.168.56.103:49206 2029340 ET INFO TLS Handshake Failure Potentially Bad Traffic
TCP 168.197.250.14:80 -> 192.168.56.103:49210 2029340 ET INFO TLS Handshake Failure Potentially Bad Traffic
TCP 192.168.56.103:49221 -> 177.72.80.14:7080 2028401 ET JA3 Hash - Possible Malware - Various Trickbot/Kovter/Dridex Unknown Traffic
TCP 192.168.56.103:49164 -> 51.178.61.60:443 2028401 ET JA3 Hash - Possible Malware - Various Trickbot/Kovter/Dridex Unknown Traffic
TCP 192.168.56.103:49180 -> 177.72.80.14:7080 2028401 ET JA3 Hash - Possible Malware - Various Trickbot/Kovter/Dridex Unknown Traffic
TCP 51.210.242.234:8080 -> 192.168.56.103:49185 2029340 ET INFO TLS Handshake Failure Potentially Bad Traffic
TCP 192.168.56.103:49188 -> 142.4.219.173:8080 2028401 ET JA3 Hash - Possible Malware - Various Trickbot/Kovter/Dridex Unknown Traffic
TCP 45.79.33.48:8080 -> 192.168.56.103:49214 2029340 ET INFO TLS Handshake Failure Potentially Bad Traffic
TCP 177.72.80.14:7080 -> 192.168.56.103:49222 2029340 ET INFO TLS Handshake Failure Potentially Bad Traffic
TCP 192.168.56.103:49225 -> 51.210.242.234:8080 2028401 ET JA3 Hash - Possible Malware - Various Trickbot/Kovter/Dridex Unknown Traffic
TCP 142.4.219.173:8080 -> 192.168.56.103:49231 2029340 ET INFO TLS Handshake Failure Potentially Bad Traffic

Suricata TLS

No Suricata TLS

Time & API Arguments Status Return Repeated

GetComputerNameA

 computer_name: TEST22-PC
1 1 0
Time & API Arguments Status Return Repeated

IsDebuggerPresent

 0 0
ip 142.4.219.173
ip 177.72.80.14
ip 196.44.98.190
ip 45.79.33.48
ip 51.210.242.234
Time & API Arguments Status Return Repeated

NtProtectVirtualMemory

 process_identifier: 2356
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x73eb4000
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2356
region_size: 163840
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x10000000
allocation_type: 12288 (MEM_COMMIT|MEM_RESERVE)
process_handle: 0xffffffff
1 0 0

NtProtectVirtualMemory

 process_identifier: 2356
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x73e10000
process_handle: 0xffffffff
1 0 0

NtProtectVirtualMemory

 process_identifier: 2356
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x73f01000
process_handle: 0xffffffff
1 0 0

NtProtectVirtualMemory

 process_identifier: 2356
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x73ee1000
process_handle: 0xffffffff
1 0 0

NtProtectVirtualMemory

 process_identifier: 2356
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x74bc1000
process_handle: 0xffffffff
1 0 0

NtProtectVirtualMemory

 process_identifier: 2356
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x76741000
process_handle: 0xffffffff
1 0 0

NtProtectVirtualMemory

 process_identifier: 2356
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x74fd1000
process_handle: 0xffffffff
1 0 0

NtProtectVirtualMemory

 process_identifier: 2356
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x75981000
process_handle: 0xffffffff
1 0 0

NtProtectVirtualMemory

 process_identifier: 2356
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x74271000
process_handle: 0xffffffff
1 0 0

NtProtectVirtualMemory

 process_identifier: 2356
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x73dc1000
process_handle: 0xffffffff
1 0 0
Time & API Arguments Status Return Repeated

Process32NextW

 snapshot_handle: 0x00000158
process_name: mobsync.exe
process_identifier: 1584
1 1 0

Process32NextW

 snapshot_handle: 0x00000158
process_name: taskhost.exe
process_identifier: 2132
1 1 0

Process32NextW

 snapshot_handle: 0x00000158
process_name: wsqmcons.exe
process_identifier: 2148
1 1 0

Process32NextW

 snapshot_handle: 0x00000158
process_name: sdclt.exe
process_identifier: 2156
1 1 0

Process32NextW

 snapshot_handle: 0x00000158
process_name: cmd.exe
process_identifier: 2268
1 1 0

Process32NextW

 snapshot_handle: 0x00000158
process_name: conhost.exe
process_identifier: 2276
1 1 0

Process32NextW

 snapshot_handle: 0x00000158
process_name: pw.exe
process_identifier: 2340
1 1 0

Process32NextW

 snapshot_handle: 0x00000158
process_name: rundll32.exe
process_identifier: 2356
1 1 0
section {u'size_of_data': u'0x00033000', u'virtual_address': u'0x00001000', u'entropy': 7.497196257790259, u'name': u'.text', u'virtual_size': u'0x00032f04'} entropy 7.49719625779 description A section with a high entropy has been found
entropy 0.811133200795 description Overall entropy of this PE file is high
process rundll32.exe
host 142.4.219.173
host 168.197.250.14
host 177.72.80.14
host 185.148.169.10
host 191.252.103.16
host 195.154.146.35
host 195.77.239.39
host 196.44.98.190
host 207.148.81.119
host 37.44.244.177
host 37.59.209.141
host 45.79.33.48
host 51.178.61.60
host 51.210.242.234
host 54.37.228.122
host 54.38.242.185
host 66.42.57.149
host 78.46.73.125
host 78.47.204.80
host 85.214.67.203
dead_host 192.168.56.103:49193
dead_host 192.168.56.103:49236
dead_host 191.252.103.16:80
dead_host 192.168.56.103:49201
dead_host 195.154.146.35:443
dead_host 78.47.204.80:443
dead_host 192.168.56.103:49198
dead_host 192.168.56.103:49237
dead_host 192.168.56.103:49187
dead_host 192.168.56.103:49240
dead_host 54.38.242.185:443
dead_host 192.168.56.103:49233
dead_host 192.168.56.103:49199
dead_host 195.77.239.39:8080
dead_host 192.168.56.103:49202
dead_host 66.42.57.149:443
dead_host 192.168.56.103:49195
dead_host 207.148.81.119:8080
dead_host 185.148.169.10:8080
dead_host 192.168.56.103:49241
dead_host 192.168.56.103:49234
dead_host 85.214.67.203:8080
dead_host 192.168.56.103:49238
dead_host 192.168.56.103:49196
dead_host 78.46.73.125:443
dead_host 192.168.56.103:49203
dead_host 192.168.56.103:49192
dead_host 37.44.244.177:8080
dead_host 192.168.56.103:49239
dead_host 192.168.56.103:49197
dead_host 54.37.228.122:443
dead_host 192.168.56.103:49228
dead_host 192.168.56.103:49242
dead_host 192.168.56.103:49200
dead_host 37.59.209.141:8080