Summary | ZeroBOX

Category	Machine	Started	Completed
FILE	s1_win7_x6403_us	Jan. 20, 2022, 10:17 a.m.	Jan. 20, 2022, 10:20 a.m.

Size	592.0KB
Type	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
MD5	`ffd6fae5e42ab50ef3f4bf0c8d9f59a1`
SHA256	`f19ae18c93ce571e53389f2691c5e6a9568c17975fd9fb7c1747ae46a19198f1`
CRC32	`CFD19B02`
ssdeep	`6144:LW/LM7l7777WVzQa1Cl0U1DDeialPTSjT0q//nXdzYYcIkptHMCLb2FN/Va8SAGp:lrHa5TS8gNMYcdptQuxV24k3Ayg`
Yara	Malicious_Packer_Zero - Malicious Packer PE_Header_Zero - PE File Signature OS_Processor_Check_Zero - OS Processor Check IsPE32 - (no description) Malicious_Library_Zero - Malicious_Library IsDLL - (no description) UPX_Zero - UPX packed file

rundll32.exe "C:\Windows\System32\rundll32.exe" C:\Users\test22\AppData\Local\Temp\jENwrgafB7p8NwZ.dll,
2440
rundll32.exe "C:\Windows\System32\rundll32.exe" C:\Users\test22\AppData\Local\Temp\jENwrgafB7p8NwZ.dll,DllRegisterServer
2344

Name	Response	Post-Analysis Lookup
No hosts contacted.

IP Address	Status	Action
103.75.201.2	Active	Moloch
103.8.26.102	Active	Moloch
103.8.26.103	Active	Moloch
104.168.155.129	Active	Moloch
104.251.214.46	Active	Moloch
131.100.24.231	Active	Moloch
158.69.222.101	Active	Moloch
173.212.193.249	Active	Moloch
176.104.106.96	Active	Moloch
178.63.25.185	Active	Moloch
178.79.147.66	Active	Moloch
192.254.71.210	Active	Moloch
203.114.109.124	Active	Moloch
207.38.84.195	Active	Moloch
209.59.138.75	Active	Moloch
212.237.17.99	Active	Moloch
212.237.56.116	Active	Moloch
216.158.226.206	Active	Moloch
217.182.143.207	Active	Moloch
45.118.115.99	Active	Moloch
45.118.135.203	Active	Moloch
45.142.114.231	Active	Moloch
45.176.232.124	Active	Moloch
46.55.222.11	Active	Moloch
50.116.54.215	Active	Moloch
51.38.71.0	Active	Moloch
51.68.175.8	Active	Moloch
58.227.42.236	Active	Moloch
79.172.212.216	Active	Moloch
81.0.236.90	Active	Moloch

Suricata Alerts

No Suricata Alerts

Suricata TLS

No Suricata TLS

Queries for the computername (1 event)

Time & API	Arguments	Status	Return	Repeated
GetComputerNameA Jan. 20, 2022, 10:17 a.m.	computer_name: TEST22-PC	1	1	0

Checks if process is being debugged by a debugger (1 event)

Time & API	Arguments	Status	Return	Repeated
IsDebuggerPresent Jan. 20, 2022, 10:17 a.m.			0	0

The file contains an unknown PE resource name possibly indicative of a packer (1 event)

resource name

None

HTTP traffic contains suspicious features which may be indicative of malware related traffic (1 event)

suspicious_features

GET method with no useragent header, Connection to IP address

suspicious_request

GET https://216.158.226.206/RFoJGKkQwbTqKHMZNaWsxQDlwpcMMbwVWVYM

Performs some HTTP requests (1 event)

request

GET https://216.158.226.206/RFoJGKkQwbTqKHMZNaWsxQDlwpcMMbwVWVYM

Communication to multiple IPs on high port numbers possibly indicative of a peer-to-peer (P2P) or non-standard command and control protocol (5 events)

ip	103.8.26.102
ip	103.8.26.103
ip	104.168.155.129
ip	209.59.138.75
ip	51.68.175.8

Allocates read-write-execute memory (usually to unpack itself) (22 events)

Time & API	Arguments	Status
NtProtectVirtualMemory Jan. 20, 2022, 10:17 a.m.	process_identifier: 2344 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x1004e000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Jan. 20, 2022, 10:17 a.m.	process_identifier: 2344 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x753d1000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Jan. 20, 2022, 10:17 a.m.	process_identifier: 2344 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x73ea1000 process_handle: 0xffffffff	1
NtAllocateVirtualMemory Jan. 20, 2022, 10:17 a.m.	process_identifier: 2344 region_size: 143360 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00400000 allocation_type: 12289 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0xffffffff	1
NtProtectVirtualMemory Jan. 20, 2022, 10:17 a.m.	process_identifier: 2344 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x73e30000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Jan. 20, 2022, 10:17 a.m.	process_identifier: 2344 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x73e01000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Jan. 20, 2022, 10:17 a.m.	process_identifier: 2344 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x73de1000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Jan. 20, 2022, 10:17 a.m.	process_identifier: 2344 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x74bc1000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Jan. 20, 2022, 10:17 a.m.	process_identifier: 2344 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x76741000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Jan. 20, 2022, 10:17 a.m.	process_identifier: 2344 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x74fd1000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Jan. 20, 2022, 10:17 a.m.	process_identifier: 2344 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x75981000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Jan. 20, 2022, 10:17 a.m.	process_identifier: 2344 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x73dd1000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Jan. 20, 2022, 10:17 a.m.	process_identifier: 2344 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x73d91000 process_handle: 0xffffffff	1
NtAllocateVirtualMemory Jan. 20, 2022, 10:17 a.m.	process_identifier: 2344 region_size: 143360 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x01fb0000 allocation_type: 12289 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Jan. 20, 2022, 10:17 a.m.	process_identifier: 2344 region_size: 143360 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x024f0000 allocation_type: 12289 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Jan. 20, 2022, 10:17 a.m.	process_identifier: 2344 region_size: 143360 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x026a0000 allocation_type: 12289 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Jan. 20, 2022, 10:17 a.m.	process_identifier: 2344 region_size: 143360 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x02730000 allocation_type: 12289 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Jan. 20, 2022, 10:17 a.m.	process_identifier: 2344 region_size: 143360 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x02960000 allocation_type: 12289 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Jan. 20, 2022, 10:17 a.m.	process_identifier: 2344 region_size: 143360 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x02a30000 allocation_type: 12289 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Jan. 20, 2022, 10:17 a.m.	process_identifier: 2344 region_size: 143360 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x02bc0000 allocation_type: 12289 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Jan. 20, 2022, 10:18 a.m.	process_identifier: 2344 region_size: 143360 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x02ca0000 allocation_type: 12289 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Jan. 20, 2022, 10:18 a.m.	process_identifier: 2344 region_size: 143360 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x02d00000 allocation_type: 12289 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0xffffffff	1

Searches running processes potentially to identify processes for sandbox evasion, code injection or memory dumping (2 events)

Time & API	Arguments	Status	Return	Repeated
Process32NextW Jan. 20, 2022, 10:17 a.m.	snapshot_handle: 0x0000016c process_name: sdclt.exe process_identifier: 2156	1	1	0
Process32NextW Jan. 20, 2022, 10:17 a.m.	snapshot_handle: 0x0000016c process_name: conhost.exe process_identifier: 2260	1	1	0

Changes read-write memory protection to read-execute (probably to avoid detection when setting all RWX flags at the same time) (1 event)

Time & API	Arguments	Status	Return	Repeated
NtProtectVirtualMemory Jan. 20, 2022, 10:17 a.m.	process_identifier: 2344 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 length: 139264 protection: 32 (PAGE_EXECUTE_READ) base_address: 0x00871000 process_handle: 0xffffffff	1	0	0

The binary likely contains encrypted or compressed data indicative of a packer (2 events)

section

{u'size_of_data': u'0x00024e00', u'virtual_address': u'0x0005f000', u'entropy': 7.9231185458931765, u'name': u'.data', u'virtual_size': u'0x000289bc'}

entropy

7.92311854589

description

A section with a high entropy has been found

entropy

0.249576988156

description

Overall entropy of this PE file is high

Expresses interest in specific running processes (1 event)

process

rundll32.exe

Communicates with host for which no DNS query was performed (30 events)

host	103.75.201.2
host	103.8.26.102
host	103.8.26.103
host	104.168.155.129
host	104.251.214.46
host	131.100.24.231
host	158.69.222.101
host	173.212.193.249
host	176.104.106.96
host	178.63.25.185
host	178.79.147.66
host	192.254.71.210
host	203.114.109.124
host	207.38.84.195
host	209.59.138.75
host	212.237.17.99
host	212.237.56.116
host	216.158.226.206
host	217.182.143.207
host	45.118.115.99
host	45.118.135.203
host	45.142.114.231
host	45.176.232.124
host	46.55.222.11
host	50.116.54.215
host	51.38.71.0
host	51.68.175.8
host	58.227.42.236
host	79.172.212.216
host	81.0.236.90

Generates some ICMP traffic

Connects to IP addresses that are no longer responding to requests (legitimate services will remain up-and-running usually) (37 events)

dead_host	45.118.135.203:7080
dead_host	192.168.56.103:49181
dead_host	192.168.56.103:49212
dead_host	212.237.17.99:8080
dead_host	192.168.56.103:49208
dead_host	217.182.143.207:443
dead_host	203.114.109.124:443
dead_host	81.0.236.90:443
dead_host	45.142.114.231:8080
dead_host	192.168.56.103:49198
dead_host	192.168.56.103:49204
dead_host	103.75.201.2:443
dead_host	178.63.25.185:443
dead_host	192.168.56.103:49182
dead_host	192.168.56.103:49187
dead_host	104.251.214.46:8080
dead_host	192.168.56.103:49209
dead_host	192.168.56.103:49218
dead_host	192.168.56.103:49199
dead_host	207.38.84.195:8080
dead_host	173.212.193.249:8080
dead_host	192.254.71.210:443
dead_host	176.104.106.96:8080
dead_host	45.118.115.99:8080
dead_host	192.168.56.103:49207
dead_host	192.168.56.103:49196
dead_host	178.79.147.66:8080
dead_host	192.168.56.103:49210
dead_host	45.176.232.124:443
dead_host	58.227.42.236:80
dead_host	158.69.222.101:443
dead_host	212.237.56.116:7080
dead_host	192.168.56.103:49215
dead_host	192.168.56.103:49216
dead_host	79.172.212.216:8080
dead_host	192.168.56.103:49180
dead_host	192.168.56.103:49211

jENwrgafB7p8NwZ

Process Tree Toggle all

Network Toggle all

Suricata Toggle all

Suricata Alerts

Suricata TLS

Signatures Toggle All