Summary | ZeroBOX

Category	Machine	Started	Completed
FILE	s1_win7_x6401	Jan. 20, 2022, 10:16 a.m.	Jan. 20, 2022, 10:24 a.m.

Size	592.0KB
Type	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
MD5	`397fbe9df87a5fa046c2273f3c17e38d`
SHA256	`b069a45f27f714faaf91cb78001fc4a4a44d793977315bd85cbf97022e769ac2`
CRC32	`31EB9074`
ssdeep	`6144:LW/LM7l7777WVzQa1Cl0U1DDeialPTSjT0q//nXdzYYcIkptHMCLb2FNqVa8SAGp:lrHa5TS8gNMYcdptQfxV24k3Ayg`
Yara	Malicious_Packer_Zero - Malicious Packer PE_Header_Zero - PE File Signature OS_Processor_Check_Zero - OS Processor Check IsPE32 - (no description) Malicious_Library_Zero - Malicious_Library IsDLL - (no description) UPX_Zero - UPX packed file

rundll32.exe "C:\Windows\System32\rundll32.exe" C:\Users\test22\AppData\Local\Temp\V2LD0vsK5Gg50dHb.dll,DllRegisterServer
2748
rundll32.exe "C:\Windows\System32\rundll32.exe" C:\Users\test22\AppData\Local\Temp\V2LD0vsK5Gg50dHb.dll,
2860

Name	Response	Post-Analysis Lookup
No hosts contacted.

IP Address	Status	Action
103.75.201.2	Active	Moloch
103.8.26.102	Active	Moloch
103.8.26.103	Active	Moloch
104.168.155.129	Active	Moloch
104.251.214.46	Active	Moloch
131.100.24.231	Active	Moloch
158.69.222.101	Active	Moloch
173.212.193.249	Active	Moloch
176.104.106.96	Active	Moloch
178.63.25.185	Active	Moloch
178.79.147.66	Active	Moloch
192.254.71.210	Active	Moloch
203.114.109.124	Active	Moloch
207.38.84.195	Active	Moloch
209.59.138.75	Active	Moloch
212.237.17.99	Active	Moloch
212.237.56.116	Active	Moloch
216.158.226.206	Active	Moloch
217.182.143.207	Active	Moloch
45.118.115.99	Active	Moloch
45.118.135.203	Active	Moloch
45.142.114.231	Active	Moloch
45.176.232.124	Active	Moloch
46.55.222.11	Active	Moloch
50.116.54.215	Active	Moloch
51.38.71.0	Active	Moloch
51.68.175.8	Active	Moloch
58.227.42.236	Active	Moloch
79.172.212.216	Active	Moloch
81.0.236.90	Active	Moloch

Suricata Alerts

No Suricata Alerts

Suricata TLS

No Suricata TLS

Queries for the computername (1 event)

Time & API	Arguments	Status	Return	Repeated
GetComputerNameA Jan. 20, 2022, 10:16 a.m.	computer_name: TEST22-PC	1	1	0

Checks if process is being debugged by a debugger (1 event)

Time & API	Arguments	Status	Return	Repeated
IsDebuggerPresent Jan. 20, 2022, 10:16 a.m.			0	0

The file contains an unknown PE resource name possibly indicative of a packer (1 event)

resource name

None

HTTP traffic contains suspicious features which may be indicative of malware related traffic (1 event)

suspicious_features

GET method with no useragent header, Connection to IP address

suspicious_request

GET https://216.158.226.206/rnGKxpkSLnevTsijUNCVwcwkjFekqugfzBukkSmq

Performs some HTTP requests (1 event)

request

GET https://216.158.226.206/rnGKxpkSLnevTsijUNCVwcwkjFekqugfzBukkSmq

Communication to multiple IPs on high port numbers possibly indicative of a peer-to-peer (P2P) or non-standard command and control protocol (5 events)

ip	103.8.26.102
ip	103.8.26.103
ip	104.168.155.129
ip	209.59.138.75
ip	51.68.175.8

Allocates read-write-execute memory (usually to unpack itself) (25 events)

Time & API	Arguments	Status
NtProtectVirtualMemory Jan. 20, 2022, 10:16 a.m.	process_identifier: 2748 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x1004e000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Jan. 20, 2022, 10:16 a.m.	process_identifier: 2748 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x74df1000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Jan. 20, 2022, 10:16 a.m.	process_identifier: 2748 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x73e01000 process_handle: 0xffffffff	1
NtAllocateVirtualMemory Jan. 20, 2022, 10:16 a.m.	process_identifier: 2748 region_size: 143360 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00880000 allocation_type: 12289 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0xffffffff	1
NtProtectVirtualMemory Jan. 20, 2022, 10:16 a.m.	process_identifier: 2748 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x73d90000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Jan. 20, 2022, 10:16 a.m.	process_identifier: 2748 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x73ca1000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Jan. 20, 2022, 10:16 a.m.	process_identifier: 2748 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x73c64000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Jan. 20, 2022, 10:16 a.m.	process_identifier: 2748 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x73ca2000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Jan. 20, 2022, 10:16 a.m.	process_identifier: 2748 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x746d1000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Jan. 20, 2022, 10:16 a.m.	process_identifier: 2748 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x742e1000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Jan. 20, 2022, 10:16 a.m.	process_identifier: 2748 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x76941000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Jan. 20, 2022, 10:16 a.m.	process_identifier: 2748 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x75291000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Jan. 20, 2022, 10:16 a.m.	process_identifier: 2748 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x750c1000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Jan. 20, 2022, 10:16 a.m.	process_identifier: 2748 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x76451000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Jan. 20, 2022, 10:16 a.m.	process_identifier: 2748 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x73d71000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Jan. 20, 2022, 10:16 a.m.	process_identifier: 2748 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x73d31000 process_handle: 0xffffffff	1
NtAllocateVirtualMemory Jan. 20, 2022, 10:16 a.m.	process_identifier: 2748 region_size: 143360 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00aa0000 allocation_type: 12289 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Jan. 20, 2022, 10:16 a.m.	process_identifier: 2748 region_size: 143360 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x02770000 allocation_type: 12289 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Jan. 20, 2022, 10:16 a.m.	process_identifier: 2748 region_size: 143360 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x02850000 allocation_type: 12289 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Jan. 20, 2022, 10:16 a.m.	process_identifier: 2748 region_size: 143360 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x02b60000 allocation_type: 12289 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Jan. 20, 2022, 10:16 a.m.	process_identifier: 2748 region_size: 143360 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x02bd0000 allocation_type: 12289 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Jan. 20, 2022, 10:16 a.m.	process_identifier: 2748 region_size: 143360 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x02c60000 allocation_type: 12289 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Jan. 20, 2022, 10:16 a.m.	process_identifier: 2748 region_size: 143360 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x02d00000 allocation_type: 12289 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Jan. 20, 2022, 10:17 a.m.	process_identifier: 2748 region_size: 143360 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x02e60000 allocation_type: 12289 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Jan. 20, 2022, 10:17 a.m.	process_identifier: 2748 region_size: 143360 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x02f50000 allocation_type: 12289 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0xffffffff	1

Searches running processes potentially to identify processes for sandbox evasion, code injection or memory dumping (1 event)

Time & API	Arguments	Status	Return	Repeated
Process32NextW Jan. 20, 2022, 10:16 a.m.	snapshot_handle: 0x00000170 process_name: rundll32.exe process_identifier: 2748	1	1	0

Changes read-write memory protection to read-execute (probably to avoid detection when setting all RWX flags at the same time) (1 event)

Time & API	Arguments	Status	Return	Repeated
NtProtectVirtualMemory Jan. 20, 2022, 10:16 a.m.	process_identifier: 2748 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 length: 139264 protection: 32 (PAGE_EXECUTE_READ) base_address: 0x008b1000 process_handle: 0xffffffff	1	0	0

The binary likely contains encrypted or compressed data indicative of a packer (2 events)

section

{u'size_of_data': u'0x00024e00', u'virtual_address': u'0x0005f000', u'entropy': 7.9231185458931765, u'name': u'.data', u'virtual_size': u'0x000289bc'}

entropy

7.92311854589

description

A section with a high entropy has been found

entropy

0.249576988156

description

Overall entropy of this PE file is high

Expresses interest in specific running processes (1 event)

process

rundll32.exe

Communicates with host for which no DNS query was performed (30 events)

host	103.75.201.2
host	103.8.26.102
host	103.8.26.103
host	104.168.155.129
host	104.251.214.46
host	131.100.24.231
host	158.69.222.101
host	173.212.193.249
host	176.104.106.96
host	178.63.25.185
host	178.79.147.66
host	192.254.71.210
host	203.114.109.124
host	207.38.84.195
host	209.59.138.75
host	212.237.17.99
host	212.237.56.116
host	216.158.226.206
host	217.182.143.207
host	45.118.115.99
host	45.118.135.203
host	45.142.114.231
host	45.176.232.124
host	46.55.222.11
host	50.116.54.215
host	51.38.71.0
host	51.68.175.8
host	58.227.42.236
host	79.172.212.216
host	81.0.236.90

File has been identified by 12 AntiVirus engines on VirusTotal as malicious (12 events)

Elastic	malicious (high confidence)
FireEye	Generic.mg.397fbe9df87a5fa0
Cyren	W32/Emotet.EEL.gen!Eldorado
Symantec	ML.Attribute.HighConfidence
Kaspersky	VHO:Trojan-Banker.Win32.Convagent.gen
McAfee-GW-Edition	BehavesLike.Win32.Emotet.hh
Sophos	ML/PE-A
SentinelOne	Static AI - Malicious PE
Microsoft	Trojan:Win32/Wacatac.B!ml
Cynet	Malicious (score: 100)
VBA32	BScope.Trojan-Banker.Emotet
APEX	Malicious

Generates some ICMP traffic

Connects to IP addresses that are no longer responding to requests (legitimate services will remain up-and-running usually) (37 events)

dead_host	192.168.56.101:49181
dead_host	212.237.17.99:8080
dead_host	192.168.56.101:49196
dead_host	192.168.56.101:49206
dead_host	45.142.114.231:8080
dead_host	203.114.109.124:443
dead_host	81.0.236.90:443
dead_host	192.168.56.101:49180
dead_host	192.168.56.101:49203
dead_host	192.168.56.101:49210
dead_host	103.75.201.2:443
dead_host	178.63.25.185:443
dead_host	192.168.56.101:49197
dead_host	104.251.214.46:8080
dead_host	192.168.56.101:49207
dead_host	207.38.84.195:8080
dead_host	192.168.56.101:49216
dead_host	45.118.135.203:7080
dead_host	173.212.193.249:8080
dead_host	192.168.56.101:49208
dead_host	192.254.71.210:443
dead_host	192.168.56.101:49198
dead_host	176.104.106.96:8080
dead_host	45.118.115.99:8080
dead_host	192.168.56.101:49209
dead_host	217.182.143.207:443
dead_host	178.79.147.66:8080
dead_host	192.168.56.101:49182
dead_host	45.176.232.124:443
dead_host	192.168.56.101:49213
dead_host	158.69.222.101:443
dead_host	212.237.56.116:7080
dead_host	58.227.42.236:80
dead_host	79.172.212.216:8080
dead_host	192.168.56.101:49187
dead_host	192.168.56.101:49205
dead_host	192.168.56.101:49214

V2LD0vsK5Gg50dHb

Process Tree Toggle all

Network Toggle all

Suricata Toggle all

Suricata Alerts

Suricata TLS

Signatures Toggle All