Summary | ZeroBOX

Category	Machine	Started	Completed
FILE	s1_win7_x6401	Jan. 21, 2022, 10:11 a.m.	Jan. 21, 2022, 10:13 a.m.

Size	624.0KB
Type	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
MD5	`5e0566f6d637adbd87305470aa05d9db`
SHA256	`eaa92e10a674a48b8f6981e9d59f5c5e66e90dc8e8af99adc589b73265890e6e`
CRC32	`FA6D4AA6`
ssdeep	`12288:Td0saabmsb61ZuV3ZGuyfEgXkvPLEbsWrxD8iP29pi9NaG1DjsgqXXvhhcwEPwqh:68mi61ZuRZGuyfEgXkvPLEbsODYDYVnm`
Yara	Malicious_Packer_Zero - Malicious Packer PE_Header_Zero - PE File Signature OS_Processor_Check_Zero - OS Processor Check IsPE32 - (no description) Malicious_Library_Zero - Malicious_Library IsDLL - (no description) UPX_Zero - UPX packed file Win32_Trojan_Emotet_1_Zero - Win32 Trojan Emotet

rundll32.exe "C:\Windows\System32\rundll32.exe" C:\Users\test22\AppData\Local\Temp\HyMifM.dll,DllRegisterServer
2764
rundll32.exe "C:\Windows\System32\rundll32.exe" C:\Users\test22\AppData\Local\Temp\HyMifM.dll,
2860

Name	Response	Post-Analysis Lookup
No hosts contacted.

IP Address	Status	Action
103.75.201.2	Active	Moloch
103.8.26.102	Active	Moloch
103.8.26.103	Active	Moloch
104.168.155.129	Active	Moloch
104.251.214.46	Active	Moloch
131.100.24.231	Active	Moloch
158.69.222.101	Active	Moloch
173.212.193.249	Active	Moloch
176.104.106.96	Active	Moloch
178.63.25.185	Active	Moloch
178.79.147.66	Active	Moloch
192.254.71.210	Active	Moloch
203.114.109.124	Active	Moloch
207.38.84.195	Active	Moloch
209.59.138.75	Active	Moloch
212.237.17.99	Active	Moloch
212.237.56.116	Active	Moloch
216.158.226.206	Active	Moloch
217.182.143.207	Active	Moloch
45.118.115.99	Active	Moloch
45.118.135.203	Active	Moloch
45.142.114.231	Active	Moloch
45.176.232.124	Active	Moloch
46.55.222.11	Active	Moloch
50.116.54.215	Active	Moloch
51.38.71.0	Active	Moloch
51.68.175.8	Active	Moloch
58.227.42.236	Active	Moloch
79.172.212.216	Active	Moloch
81.0.236.90	Active	Moloch

Suricata Alerts

No Suricata Alerts

Suricata TLS

No Suricata TLS

Queries for the computername (1 event)

Time & API	Arguments	Status	Return	Repeated
GetComputerNameA Jan. 21, 2022, 10:11 a.m.	computer_name: TEST22-PC	1	1	0

Checks if process is being debugged by a debugger (1 event)

Time & API	Arguments	Status	Return	Repeated
IsDebuggerPresent Jan. 21, 2022, 10:11 a.m.			0	0

The file contains an unknown PE resource name possibly indicative of a packer (1 event)

resource name

None

HTTP traffic contains suspicious features which may be indicative of malware related traffic (1 event)

suspicious_features

GET method with no useragent header, Connection to IP address

suspicious_request

GET https://216.158.226.206/tGZKQVEPhVnxwfhuDvlpZfGAcjHlERyUyRAYZHoGiHfcxwJmqgiICeJrWs

Performs some HTTP requests (1 event)

request

GET https://216.158.226.206/tGZKQVEPhVnxwfhuDvlpZfGAcjHlERyUyRAYZHoGiHfcxwJmqgiICeJrWs

Communication to multiple IPs on high port numbers possibly indicative of a peer-to-peer (P2P) or non-standard command and control protocol (5 events)

ip	103.8.26.102
ip	103.8.26.103
ip	104.168.155.129
ip	209.59.138.75
ip	51.68.175.8

Allocates read-write-execute memory (usually to unpack itself) (27 events)

Time & API	Arguments	Status
NtProtectVirtualMemory Jan. 21, 2022, 10:11 a.m.	process_identifier: 2764 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x1004f000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Jan. 21, 2022, 10:11 a.m.	process_identifier: 2764 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x74df1000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Jan. 21, 2022, 10:11 a.m.	process_identifier: 2764 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x73e01000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Jan. 21, 2022, 10:11 a.m.	process_identifier: 2764 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x742e1000 process_handle: 0xffffffff	1
NtAllocateVirtualMemory Jan. 21, 2022, 10:11 a.m.	process_identifier: 2764 region_size: 143360 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00340000 allocation_type: 12289 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0xffffffff	1
NtProtectVirtualMemory Jan. 21, 2022, 10:11 a.m.	process_identifier: 2764 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x73d90000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Jan. 21, 2022, 10:11 a.m.	process_identifier: 2764 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x73ca1000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Jan. 21, 2022, 10:11 a.m.	process_identifier: 2764 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x73c64000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Jan. 21, 2022, 10:11 a.m.	process_identifier: 2764 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x73ca2000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Jan. 21, 2022, 10:11 a.m.	process_identifier: 2764 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x73d61000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Jan. 21, 2022, 10:11 a.m.	process_identifier: 2764 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x73d41000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Jan. 21, 2022, 10:11 a.m.	process_identifier: 2764 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x76941000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Jan. 21, 2022, 10:11 a.m.	process_identifier: 2764 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x75291000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Jan. 21, 2022, 10:11 a.m.	process_identifier: 2764 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x750c1000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Jan. 21, 2022, 10:11 a.m.	process_identifier: 2764 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x76451000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Jan. 21, 2022, 10:11 a.m.	process_identifier: 2764 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x746d1000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Jan. 21, 2022, 10:11 a.m.	process_identifier: 2764 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x73b31000 process_handle: 0xffffffff	1
NtAllocateVirtualMemory Jan. 21, 2022, 10:11 a.m.	process_identifier: 2764 region_size: 143360 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x024d0000 allocation_type: 12289 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Jan. 21, 2022, 10:11 a.m.	process_identifier: 2764 region_size: 143360 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x02740000 allocation_type: 12289 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Jan. 21, 2022, 10:11 a.m.	process_identifier: 2764 region_size: 143360 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x02840000 allocation_type: 12289 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Jan. 21, 2022, 10:11 a.m.	process_identifier: 2764 region_size: 143360 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x029d0000 allocation_type: 12289 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Jan. 21, 2022, 10:11 a.m.	process_identifier: 2764 region_size: 143360 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x02a40000 allocation_type: 12289 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Jan. 21, 2022, 10:11 a.m.	process_identifier: 2764 region_size: 143360 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x02b70000 allocation_type: 12289 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Jan. 21, 2022, 10:11 a.m.	process_identifier: 2764 region_size: 143360 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x02d90000 allocation_type: 12289 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Jan. 21, 2022, 10:12 a.m.	process_identifier: 2764 region_size: 143360 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x02e10000 allocation_type: 12289 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Jan. 21, 2022, 10:12 a.m.	process_identifier: 2764 region_size: 143360 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x02ed0000 allocation_type: 12289 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Jan. 21, 2022, 10:12 a.m.	process_identifier: 2764 region_size: 143360 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x02ce0000 allocation_type: 12289 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0xffffffff	1

File has been identified by 6 AntiVirus engines on VirusTotal as malicious (6 events)

Elastic	malicious (high confidence)
FireEye	Generic.mg.5e0566f6d637adbd
APEX	Malicious
Cynet	Malicious (score: 100)
Kaspersky	VHO:Trojan-Banker.Win32.Emotet.gen
Rising	Malware.Strealer!8.1EF (C64:YzY0OmNYIOKEG6Ko)

Changes read-write memory protection to read-execute (probably to avoid detection when setting all RWX flags at the same time) (1 event)

Time & API	Arguments	Status	Return	Repeated
NtProtectVirtualMemory Jan. 21, 2022, 10:11 a.m.	process_identifier: 2764 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 length: 139264 protection: 32 (PAGE_EXECUTE_READ) base_address: 0x00371000 process_handle: 0xffffffff	1	0	0

The binary likely contains encrypted or compressed data indicative of a packer (2 events)

section

{u'size_of_data': u'0x00025000', u'virtual_address': u'0x00061000', u'entropy': 7.927056845303506, u'name': u'.data', u'virtual_size': u'0x00028698'}

entropy

7.9270568453

description

A section with a high entropy has been found

entropy

0.238709677419

description

Overall entropy of this PE file is high

Expresses interest in specific running processes (1 event)

process

rundll32.exe

Communicates with host for which no DNS query was performed (30 events)

host	103.75.201.2
host	103.8.26.102
host	103.8.26.103
host	104.168.155.129
host	104.251.214.46
host	131.100.24.231
host	158.69.222.101
host	173.212.193.249
host	176.104.106.96
host	178.63.25.185
host	178.79.147.66
host	192.254.71.210
host	203.114.109.124
host	207.38.84.195
host	209.59.138.75
host	212.237.17.99
host	212.237.56.116
host	216.158.226.206
host	217.182.143.207
host	45.118.115.99
host	45.118.135.203
host	45.142.114.231
host	45.176.232.124
host	46.55.222.11
host	50.116.54.215
host	51.38.71.0
host	51.68.175.8
host	58.227.42.236
host	79.172.212.216
host	81.0.236.90

Generates some ICMP traffic

Connects to IP addresses that are no longer responding to requests (legitimate services will remain up-and-running usually) (37 events)

dead_host	192.168.56.101:49181
dead_host	192.168.56.101:49211
dead_host	212.237.17.99:8080
dead_host	192.168.56.101:49196
dead_host	45.142.114.231:8080
dead_host	192.168.56.101:49215
dead_host	203.114.109.124:443
dead_host	81.0.236.90:443
dead_host	192.168.56.101:49180
dead_host	192.168.56.101:49203
dead_host	103.75.201.2:443
dead_host	178.63.25.185:443
dead_host	192.168.56.101:49197
dead_host	104.251.214.46:8080
dead_host	192.168.56.101:49207
dead_host	192.168.56.101:49208
dead_host	207.38.84.195:8080
dead_host	192.168.56.101:49216
dead_host	45.118.135.203:7080
dead_host	192.168.56.101:49212
dead_host	173.212.193.249:8080
dead_host	192.254.71.210:443
dead_host	192.168.56.101:49198
dead_host	176.104.106.96:8080
dead_host	45.118.115.99:8080
dead_host	192.168.56.101:49209
dead_host	217.182.143.207:443
dead_host	178.79.147.66:8080
dead_host	192.168.56.101:49182
dead_host	45.176.232.124:443
dead_host	158.69.222.101:443
dead_host	212.237.56.116:7080
dead_host	58.227.42.236:80
dead_host	79.172.212.216:8080
dead_host	192.168.56.101:49210
dead_host	192.168.56.101:49187
dead_host	192.168.56.101:49218

HyMifM

Process Tree Toggle all

Network Toggle all

Suricata Toggle all

Suricata Alerts

Suricata TLS

Signatures Toggle All