popup
Summary | ZeroBOX
  1. Home
  2. Result
  3. Report
  4. Detail Analysis

XUBS

Emotet Malicious Library UPX PE File DLL OS Processor Check PE32
  1. Resubmit sample
Category Machine Started Completed
FILE s1_win7_x6403_us Nov. 18, 2021, 8:41 a.m. Nov. 18, 2021, 8:43 a.m.
Size 252.5KB
Type PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
MD5 86a05c561153b2d3c796ce5162523c40
SHA256 878b3a30ac7263f56a7969c784cd4314dd55d994d580852e8a17d7e30d1f8601
CRC32 2C8C12EB
ssdeep 6144:ndH09uYgR7OJSuwuZc2HEaYTy7beWTBdvm:dHJtlec2HEaYTXWT/u
Yara
  • Win32_Trojan_Emotet_RL_Gen_Zero - Win32 Trojan Emotet
  • PE_Header_Zero - PE File Signature
  • OS_Processor_Check_Zero - OS Processor Check
  • IsPE32 - (no description)
  • Win32_Trojan_Emotet_RL_1_Zero - Win32 Trojan Emotet
  • IsDLL - (no description)
  • Win32_Trojan_Emotet_RL_2_Zero - Win32 Trojan Emotet
  • Malicious_Library_Zero - Malicious_Library
  • UPX_Zero - UPX packed file

Name Response Post-Analysis Lookup
No hosts contacted.
IP Address Status Action
103.75.201.2 Active Moloch
103.8.26.102 Active Moloch
103.8.26.103 Active Moloch
104.251.214.46 Active Moloch
107.182.225.142 Active Moloch
110.232.117.186 Active Moloch
138.185.72.26 Active Moloch
158.69.222.101 Active Moloch
176.104.106.96 Active Moloch
178.79.147.66 Active Moloch
185.184.25.237 Active Moloch
191.252.196.221 Active Moloch
195.154.133.20 Active Moloch
207.38.84.195 Active Moloch
210.57.217.132 Active Moloch
212.237.17.99 Active Moloch
212.237.5.209 Active Moloch
212.237.56.116 Active Moloch
216.158.226.206 Active Moloch
45.118.135.203 Active Moloch
45.142.114.231 Active Moloch
50.116.54.215 Active Moloch
51.68.175.8 Active Moloch
58.227.42.236 Active Moloch
66.42.55.5 Active Moloch
81.0.236.90 Active Moloch
91.200.186.228 Active Moloch
94.177.248.64 Active Moloch

Suricata Alerts

Flow SID Signature Category
TCP 91.200.186.228:443 -> 192.168.56.103:49165 2029340 ET INFO TLS Handshake Failure Potentially Bad Traffic
TCP 103.8.26.103:8080 -> 192.168.56.103:49178 2029340 ET INFO TLS Handshake Failure Potentially Bad Traffic
TCP 192.168.56.103:49168 -> 191.252.196.221:8080 2028401 ET JA3 Hash - Possible Malware - Various Trickbot/Kovter/Dridex Unknown Traffic
TCP 191.252.196.221:8080 -> 192.168.56.103:49169 2029340 ET INFO TLS Handshake Failure Potentially Bad Traffic
TCP 66.42.55.5:7080 -> 192.168.56.103:49174 2029340 ET INFO TLS Handshake Failure Potentially Bad Traffic
TCP 192.168.56.103:49184 -> 103.8.26.102:8080 2028401 ET JA3 Hash - Possible Malware - Various Trickbot/Kovter/Dridex Unknown Traffic
TCP 192.168.56.103:49172 -> 66.42.55.5:7080 2028401 ET JA3 Hash - Possible Malware - Various Trickbot/Kovter/Dridex Unknown Traffic
TCP 192.168.56.103:49181 -> 185.184.25.237:8080 2028401 ET JA3 Hash - Possible Malware - Various Trickbot/Kovter/Dridex Unknown Traffic
TCP 192.168.56.103:49185 -> 103.8.26.102:8080 2028401 ET JA3 Hash - Possible Malware - Various Trickbot/Kovter/Dridex Unknown Traffic
TCP 192.168.56.103:49188 -> 178.79.147.66:8080 2404307 ET CNC Feodo Tracker Reported CnC Server group 8 A Network Trojan was detected
TCP 192.168.56.103:49173 -> 66.42.55.5:7080 2028401 ET JA3 Hash - Possible Malware - Various Trickbot/Kovter/Dridex Unknown Traffic
TCP 192.168.56.103:49208 -> 210.57.217.132:8080 2028401 ET JA3 Hash - Possible Malware - Various Trickbot/Kovter/Dridex Unknown Traffic
TCP 192.168.56.103:49180 -> 185.184.25.237:8080 2028401 ET JA3 Hash - Possible Malware - Various Trickbot/Kovter/Dridex Unknown Traffic
TCP 192.168.56.103:49212 -> 91.200.186.228:443 2028401 ET JA3 Hash - Possible Malware - Various Trickbot/Kovter/Dridex Unknown Traffic
TCP 103.8.26.102:8080 -> 192.168.56.103:49186 2029340 ET INFO TLS Handshake Failure Potentially Bad Traffic
TCP 192.168.56.103:49217 -> 191.252.196.221:8080 2028401 ET JA3 Hash - Possible Malware - Various Trickbot/Kovter/Dridex Unknown Traffic
TCP 91.200.186.228:443 -> 192.168.56.103:49214 2029340 ET INFO TLS Handshake Failure Potentially Bad Traffic
TCP 192.168.56.103:49195 -> 207.38.84.195:8080 2404312 ET CNC Feodo Tracker Reported CnC Server group 13 A Network Trojan was detected
TCP 192.168.56.103:49216 -> 191.252.196.221:8080 2028401 ET JA3 Hash - Possible Malware - Various Trickbot/Kovter/Dridex Unknown Traffic
TCP 192.168.56.103:49205 -> 50.116.54.215:443 2404317 ET CNC Feodo Tracker Reported CnC Server group 18 A Network Trojan was detected
TCP 191.252.196.221:8080 -> 192.168.56.103:49218 2029340 ET INFO TLS Handshake Failure Potentially Bad Traffic
TCP 192.168.56.103:49222 -> 66.42.55.5:7080 2028401 ET JA3 Hash - Possible Malware - Various Trickbot/Kovter/Dridex Unknown Traffic
TCP 192.168.56.103:49226 -> 103.8.26.103:8080 2028401 ET JA3 Hash - Possible Malware - Various Trickbot/Kovter/Dridex Unknown Traffic
TCP 192.168.56.103:49167 -> 191.252.196.221:8080 2028401 ET JA3 Hash - Possible Malware - Various Trickbot/Kovter/Dridex Unknown Traffic
TCP 192.168.56.103:49163 -> 91.200.186.228:443 2028401 ET JA3 Hash - Possible Malware - Various Trickbot/Kovter/Dridex Unknown Traffic
TCP 192.168.56.103:49176 -> 103.8.26.103:8080 2028401 ET JA3 Hash - Possible Malware - Various Trickbot/Kovter/Dridex Unknown Traffic
TCP 192.168.56.103:49209 -> 210.57.217.132:8080 2028401 ET JA3 Hash - Possible Malware - Various Trickbot/Kovter/Dridex Unknown Traffic
TCP 210.57.217.132:8080 -> 192.168.56.103:49210 2029340 ET INFO TLS Handshake Failure Potentially Bad Traffic
TCP 192.168.56.103:49213 -> 91.200.186.228:443 2028401 ET JA3 Hash - Possible Malware - Various Trickbot/Kovter/Dridex Unknown Traffic
TCP 192.168.56.103:49225 -> 103.8.26.103:8080 2028401 ET JA3 Hash - Possible Malware - Various Trickbot/Kovter/Dridex Unknown Traffic
TCP 192.168.56.103:49221 -> 66.42.55.5:7080 2028401 ET JA3 Hash - Possible Malware - Various Trickbot/Kovter/Dridex Unknown Traffic
TCP 103.8.26.103:8080 -> 192.168.56.103:49227 2029340 ET INFO TLS Handshake Failure Potentially Bad Traffic
TCP 66.42.55.5:7080 -> 192.168.56.103:49223 2029340 ET INFO TLS Handshake Failure Potentially Bad Traffic
TCP 192.168.56.103:49229 -> 185.184.25.237:8080 2028401 ET JA3 Hash - Possible Malware - Various Trickbot/Kovter/Dridex Unknown Traffic
TCP 192.168.56.103:49164 -> 91.200.186.228:443 2028401 ET JA3 Hash - Possible Malware - Various Trickbot/Kovter/Dridex Unknown Traffic
TCP 192.168.56.103:49177 -> 103.8.26.103:8080 2028401 ET JA3 Hash - Possible Malware - Various Trickbot/Kovter/Dridex Unknown Traffic
TCP 185.184.25.237:8080 -> 192.168.56.103:49182 2029340 ET INFO TLS Handshake Failure Potentially Bad Traffic

Suricata TLS

No Suricata TLS

Time & API Arguments Status Return Repeated

GetComputerNameA

 computer_name: TEST22-PC
1 1 0
Time & API Arguments Status Return Repeated

IsDebuggerPresent

 0 0
ip 103.8.26.102
ip 103.8.26.103
ip 185.184.25.237
ip 191.252.196.221
ip 210.57.217.132
ip 66.42.55.5
Time & API Arguments Status Return Repeated

NtProtectVirtualMemory

 process_identifier: 2336
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x73eb4000
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2336
region_size: 163840
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x10000000
allocation_type: 12288 (MEM_COMMIT|MEM_RESERVE)
process_handle: 0xffffffff
1 0 0

NtProtectVirtualMemory

 process_identifier: 2336
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x73e10000
process_handle: 0xffffffff
1 0 0

NtProtectVirtualMemory

 process_identifier: 2336
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x73f01000
process_handle: 0xffffffff
1 0 0

NtProtectVirtualMemory

 process_identifier: 2336
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x73ee1000
process_handle: 0xffffffff
1 0 0

NtProtectVirtualMemory

 process_identifier: 2336
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x74bc1000
process_handle: 0xffffffff
1 0 0

NtProtectVirtualMemory

 process_identifier: 2336
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x76741000
process_handle: 0xffffffff
1 0 0

NtProtectVirtualMemory

 process_identifier: 2336
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x74fd1000
process_handle: 0xffffffff
1 0 0

NtProtectVirtualMemory

 process_identifier: 2336
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x75981000
process_handle: 0xffffffff
1 0 0

NtProtectVirtualMemory

 process_identifier: 2336
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x74271000
process_handle: 0xffffffff
1 0 0

NtProtectVirtualMemory

 process_identifier: 2336
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x73dc1000
process_handle: 0xffffffff
1 0 0

NtProtectVirtualMemory

 process_identifier: 2336
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x73ae1000
process_handle: 0xffffffff
1 0 0
Time & API Arguments Status Return Repeated

Process32NextW

 snapshot_handle: 0x00000158
process_name: sdclt.exe
process_identifier: 2136
1 1 0

Process32NextW

 snapshot_handle: 0x00000158
process_name: conhost.exe
process_identifier: 2256
1 1 0

Process32NextW

 snapshot_handle: 0x00000158
process_name: pw.exe
process_identifier: 2324
1 1 0

Process32NextW

 snapshot_handle: 0x00000158
process_name: rundll32.exe
process_identifier: 2336
1 1 0
section {u'size_of_data': u'0x00033000', u'virtual_address': u'0x00001000', u'entropy': 7.491743762434669, u'name': u'.text', u'virtual_size': u'0x00032e94'} entropy 7.49174376243 description A section with a high entropy has been found
entropy 0.811133200795 description Overall entropy of this PE file is high
process rundll32.exe
host 103.75.201.2
host 103.8.26.102
host 103.8.26.103
host 104.251.214.46
host 107.182.225.142
host 110.232.117.186
host 138.185.72.26
host 158.69.222.101
host 176.104.106.96
host 178.79.147.66
host 185.184.25.237
host 191.252.196.221
host 195.154.133.20
host 207.38.84.195
host 210.57.217.132
host 212.237.17.99
host 212.237.5.209
host 212.237.56.116
host 216.158.226.206
host 45.118.135.203
host 45.142.114.231
host 50.116.54.215
host 51.68.175.8
host 58.227.42.236
host 66.42.55.5
host 81.0.236.90
host 91.200.186.228
host 94.177.248.64
Bkav W32.AIDetect.malware2
Elastic malicious (high confidence)
DrWeb Trojan.Emotet.1113
MicroWorld-eScan Gen:Variant.Zusy.407338
ALYac Gen:Variant.Midie.103951
K7GW Trojan ( 0058a7f11 )
K7AntiVirus Trojan ( 0058a7f11 )
BitDefenderTheta Gen:NN.ZedlaF.34266.pq4@ayD0R7c
Cyren W32/Emotet.BDJ.gen!Eldorado
ESET-NOD32 a variant of Win32/Kryptik.HNIM
APEX Malicious
ClamAV Win.Malware.Generic-9909860-0
Kaspersky VHO:Trojan-Banker.Win32.Emotet.ghbv
BitDefender Gen:Variant.Zusy.407338
Avast Win32:BotX-gen [Trj]
Ad-Aware Gen:Variant.Midie.103951
Emsisoft Gen:Variant.Midie.103951 (B)
FireEye Generic.mg.86a05c561153b2d3
Sophos Troj/Emotet-CWR
SentinelOne Static AI - Malicious PE
Webroot W32.Trojan.Emotet
Microsoft Trojan:Win32/Emotetcrypt.GI!MTB
Arcabit Trojan.Midie.D1960F
GData Gen:Variant.Zusy.407338
Cynet Malicious (score: 100)
AhnLab-V3 Trojan/Win.BotX-gen.C4773567
McAfee Emotet-FSO!86A05C561153
MAX malware (ai score=81)
VBA32 Backdoor.Emotet
Malwarebytes Trojan.MalPack.TRE
Ikarus Trojan-Spy.Emotet
eGambit Unsafe.AI_Score_88%
Fortinet W32/Emote.CQ!tr
AVG Win32:BotX-gen [Trj]
Panda Trj/Genetic.gen
MaxSecure Trojan.Malware.300983.susgen
dead_host 192.168.56.103:49194
dead_host 192.168.56.103:49190
dead_host 94.177.248.64:443
dead_host 192.168.56.103:49205
dead_host 212.237.17.99:8080
dead_host 50.116.54.215:443
dead_host 45.142.114.231:8080
dead_host 195.154.133.20:443
dead_host 81.0.236.90:443
dead_host 192.168.56.103:49201
dead_host 192.168.56.103:49198
dead_host 192.168.56.103:49191
dead_host 103.75.201.2:443
dead_host 138.185.72.26:8080
dead_host 104.251.214.46:8080
dead_host 192.168.56.103:49206
dead_host 207.38.84.195:8080
dead_host 110.232.117.186:8080
dead_host 45.118.135.203:7080
dead_host 192.168.56.103:49188
dead_host 192.168.56.103:49202
dead_host 192.168.56.103:49195
dead_host 192.168.56.103:49199
dead_host 176.104.106.96:8080
dead_host 216.158.226.206:443
dead_host 192.168.56.103:49207
dead_host 192.168.56.103:49196
dead_host 178.79.147.66:8080
dead_host 107.182.225.142:8080
dead_host 192.168.56.103:49189
dead_host 192.168.56.103:49203
dead_host 192.168.56.103:49192
dead_host 158.69.222.101:443
dead_host 58.227.42.236:80
dead_host 192.168.56.103:49197
dead_host 212.237.56.116:7080
dead_host 212.237.5.209:443
dead_host 51.68.175.8:8080
dead_host 192.168.56.103:49200
dead_host 192.168.56.103:49204