popup
Summary | ZeroBOX
  1. Home
  2. Result
  3. Report
  4. Detail Analysis

0XCIyatvv2fEO60

Emotet Malicious Library UPX Malicious Packer PE File DLL OS Processor Check PE32
  1. Resubmit sample
Category Machine Started Completed
FILE s1_win7_x6401 Jan. 24, 2022, 9:34 a.m. Jan. 24, 2022, 9:47 a.m.
Size 615.5KB
Type PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
MD5 af2501aafd182ef4e0d631a9d7c7e9a6
SHA256 a79a5c3e7b95ef88ee14f6c520c57df3cb2a16a2b879522735a1958f7ee735fe
CRC32 736376F5
ssdeep 12288:dOzFuk7dA19ZCOo6AI/2NLaQL3kMZR+TTD7vgEPej:0hn7dA19ZCOyDaQDkqkXa
Yara
  • Malicious_Packer_Zero - Malicious Packer
  • PE_Header_Zero - PE File Signature
  • OS_Processor_Check_Zero - OS Processor Check
  • IsPE32 - (no description)
  • Malicious_Library_Zero - Malicious_Library
  • IsDLL - (no description)
  • UPX_Zero - UPX packed file
  • Win32_Trojan_Emotet_1_Zero - Win32 Trojan Emotet

Name Response Post-Analysis Lookup
No hosts contacted.
IP Address Status Action
103.75.201.2 Active Moloch
103.8.26.102 Active Moloch
103.8.26.103 Active Moloch
104.168.155.129 Active Moloch
104.251.214.46 Active Moloch
131.100.24.231 Active Moloch
158.69.222.101 Active Moloch
173.212.193.249 Active Moloch
176.104.106.96 Active Moloch
178.63.25.185 Active Moloch
178.79.147.66 Active Moloch
192.254.71.210 Active Moloch
203.114.109.124 Active Moloch
207.38.84.195 Active Moloch
209.59.138.75 Active Moloch
212.237.17.99 Active Moloch
212.237.56.116 Active Moloch
216.158.226.206 Active Moloch
217.182.143.207 Active Moloch
45.118.115.99 Active Moloch
45.118.135.203 Active Moloch
45.142.114.231 Active Moloch
45.176.232.124 Active Moloch
46.55.222.11 Active Moloch
50.116.54.215 Active Moloch
51.38.71.0 Active Moloch
51.68.175.8 Active Moloch
58.227.42.236 Active Moloch
79.172.212.216 Active Moloch
81.0.236.90 Active Moloch

Suricata Alerts

Flow SID Signature Category
TCP 192.168.56.101:49166 -> 131.100.24.231:80 2404304 ET CNC Feodo Tracker Reported CnC Server group 5 A Network Trojan was detected
TCP 192.168.56.101:49173 -> 103.8.26.103:8080 2404302 ET CNC Feodo Tracker Reported CnC Server group 3 A Network Trojan was detected
TCP 131.100.24.231:80 -> 192.168.56.101:49166 2029340 ET INFO TLS Handshake Failure Potentially Bad Traffic
TCP 192.168.56.101:49173 -> 103.8.26.103:8080 2028401 ET JA3 Hash - Possible Malware - Various Trickbot/Kovter/Dridex Unknown Traffic
TCP 192.168.56.101:49171 -> 209.59.138.75:7080 2404313 ET CNC Feodo Tracker Reported CnC Server group 14 A Network Trojan was detected
TCP 192.168.56.101:49165 -> 131.100.24.231:80 2028401 ET JA3 Hash - Possible Malware - Various Trickbot/Kovter/Dridex Unknown Traffic
TCP 103.8.26.103:8080 -> 192.168.56.101:49174 2029340 ET INFO TLS Handshake Failure Potentially Bad Traffic
TCP 192.168.56.101:49169 -> 209.59.138.75:7080 2028401 ET JA3 Hash - Possible Malware - Various Trickbot/Kovter/Dridex Unknown Traffic
TCP 192.168.56.101:49188 -> 46.55.222.11:443 2404318 ET CNC Feodo Tracker Reported CnC Server group 19 A Network Trojan was detected
TCP 192.168.56.101:49168 -> 209.59.138.75:7080 2028401 ET JA3 Hash - Possible Malware - Various Trickbot/Kovter/Dridex Unknown Traffic
TCP 192.168.56.101:49188 -> 46.55.222.11:443 2028401 ET JA3 Hash - Possible Malware - Various Trickbot/Kovter/Dridex Unknown Traffic
TCP 192.168.56.101:49184 -> 104.168.155.129:8080 2028401 ET JA3 Hash - Possible Malware - Various Trickbot/Kovter/Dridex Unknown Traffic
TCP 192.168.56.101:49183 -> 104.168.155.129:8080 2028401 ET JA3 Hash - Possible Malware - Various Trickbot/Kovter/Dridex Unknown Traffic
TCP 192.168.56.101:49172 -> 103.8.26.103:8080 2028401 ET JA3 Hash - Possible Malware - Various Trickbot/Kovter/Dridex Unknown Traffic
TCP 192.168.56.101:49187 -> 178.79.147.66:8080 2404308 ET CNC Feodo Tracker Reported CnC Server group 9 A Network Trojan was detected
TCP 192.168.56.101:49193 -> 103.8.26.102:8080 2028401 ET JA3 Hash - Possible Malware - Various Trickbot/Kovter/Dridex Unknown Traffic
TCP 192.168.56.101:49189 -> 46.55.222.11:443 2028401 ET JA3 Hash - Possible Malware - Various Trickbot/Kovter/Dridex Unknown Traffic
TCP 51.68.175.8:8080 -> 192.168.56.101:49201 2029340 ET INFO TLS Handshake Failure Potentially Bad Traffic
TCP 192.168.56.101:49199 -> 51.68.175.8:8080 2028401 ET JA3 Hash - Possible Malware - Various Trickbot/Kovter/Dridex Unknown Traffic
TCP 192.168.56.101:49200 -> 51.68.175.8:8080 2028401 ET JA3 Hash - Possible Malware - Various Trickbot/Kovter/Dridex Unknown Traffic
TCP 192.168.56.101:49215 -> 216.158.226.206:443 2028401 ET JA3 Hash - Possible Malware - Various Trickbot/Kovter/Dridex Unknown Traffic
TCP 192.168.56.101:49164 -> 131.100.24.231:80 2028401 ET JA3 Hash - Possible Malware - Various Trickbot/Kovter/Dridex Unknown Traffic
TCP 192.168.56.101:49177 -> 51.38.71.0:443 2028401 ET JA3 Hash - Possible Malware - Various Trickbot/Kovter/Dridex Unknown Traffic
TCP 51.38.71.0:443 -> 192.168.56.101:49178 2029340 ET INFO TLS Handshake Failure Potentially Bad Traffic
TCP 192.168.56.101:49180 -> 212.237.17.99:8080 2404314 ET CNC Feodo Tracker Reported CnC Server group 15 A Network Trojan was detected
TCP 104.168.155.129:8080 -> 192.168.56.101:49185 2029340 ET INFO TLS Handshake Failure Potentially Bad Traffic
TCP 46.55.222.11:443 -> 192.168.56.101:49190 2029340 ET INFO TLS Handshake Failure Potentially Bad Traffic
TCP 103.8.26.102:8080 -> 192.168.56.101:49194 2029340 ET INFO TLS Handshake Failure Potentially Bad Traffic
TCP 209.59.138.75:7080 -> 192.168.56.101:49170 2029340 ET INFO TLS Handshake Failure Potentially Bad Traffic
TCP 192.168.56.101:49176 -> 51.38.71.0:443 2028401 ET JA3 Hash - Possible Malware - Various Trickbot/Kovter/Dridex Unknown Traffic
TCP 192.168.56.101:49192 -> 103.8.26.102:8080 2028401 ET JA3 Hash - Possible Malware - Various Trickbot/Kovter/Dridex Unknown Traffic

Suricata TLS

Flow Issuer Subject Fingerprint
TLSv1
192.168.56.101:49215
216.158.226.206:443 		C=US, ST=California, L=Santa Clara, O=Oracle Corporation, OU=GlassFish, CN=server.zeropapeles.com C=US, ST=California, L=Santa Clara, O=Oracle Corporation, OU=GlassFish, CN=server.zeropapeles.com 2b:7a:c3:4b:fd:e8:29:ea:46:94:66:8a:9a:4e:bf:be:e9:f2:9a:1e

Time & API Arguments Status Return Repeated

GetComputerNameA

 computer_name: TEST22-PC
1 1 0
Time & API Arguments Status Return Repeated

IsDebuggerPresent

 0 0
resource name None
suspicious_features GET method with no useragent header, Connection to IP address suspicious_request GET https://216.158.226.206/TbinMujbCpADYUHbogPMyZxrbzXKucqRDwhPKUnoFassdiHzIHppBEcqAkTYhQu
request GET https://216.158.226.206/TbinMujbCpADYUHbogPMyZxrbzXKucqRDwhPKUnoFassdiHzIHppBEcqAkTYhQu
ip 103.8.26.102
ip 103.8.26.103
ip 104.168.155.129
ip 209.59.138.75
ip 51.68.175.8
Time & API Arguments Status Return Repeated

NtProtectVirtualMemory

 process_identifier: 2784
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x1004e000
process_handle: 0xffffffff
1 0 0

NtProtectVirtualMemory

 process_identifier: 2784
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x74df1000
process_handle: 0xffffffff
1 0 0

NtProtectVirtualMemory

 process_identifier: 2784
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x73e01000
process_handle: 0xffffffff
1 0 0

NtProtectVirtualMemory

 process_identifier: 2784
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x742e1000
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2784
region_size: 143360
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x00410000
allocation_type: 12289 (MEM_COMMIT|MEM_RESERVE)
process_handle: 0xffffffff
1 0 0

NtProtectVirtualMemory

 process_identifier: 2784
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x73d90000
process_handle: 0xffffffff
1 0 0

NtProtectVirtualMemory

 process_identifier: 2784
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x73ca1000
process_handle: 0xffffffff
1 0 0

NtProtectVirtualMemory

 process_identifier: 2784
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x73c64000
process_handle: 0xffffffff
1 0 0

NtProtectVirtualMemory

 process_identifier: 2784
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x73ca2000
process_handle: 0xffffffff
1 0 0

NtProtectVirtualMemory

 process_identifier: 2784
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x73d61000
process_handle: 0xffffffff
1 0 0

NtProtectVirtualMemory

 process_identifier: 2784
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x73d41000
process_handle: 0xffffffff
1 0 0

NtProtectVirtualMemory

 process_identifier: 2784
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x76941000
process_handle: 0xffffffff
1 0 0

NtProtectVirtualMemory

 process_identifier: 2784
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x75291000
process_handle: 0xffffffff
1 0 0

NtProtectVirtualMemory

 process_identifier: 2784
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x750c1000
process_handle: 0xffffffff
1 0 0

NtProtectVirtualMemory

 process_identifier: 2784
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x76451000
process_handle: 0xffffffff
1 0 0

NtProtectVirtualMemory

 process_identifier: 2784
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x746d1000
process_handle: 0xffffffff
1 0 0

NtProtectVirtualMemory

 process_identifier: 2784
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x73b31000
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2784
region_size: 143360
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x00b00000
allocation_type: 12289 (MEM_COMMIT|MEM_RESERVE)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2784
region_size: 143360
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x02260000
allocation_type: 12289 (MEM_COMMIT|MEM_RESERVE)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2784
region_size: 143360
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x02770000
allocation_type: 12289 (MEM_COMMIT|MEM_RESERVE)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2784
region_size: 143360
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x02a60000
allocation_type: 12289 (MEM_COMMIT|MEM_RESERVE)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2784
region_size: 143360
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x02af0000
allocation_type: 12289 (MEM_COMMIT|MEM_RESERVE)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2784
region_size: 143360
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x02c50000
allocation_type: 12289 (MEM_COMMIT|MEM_RESERVE)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2784
region_size: 143360
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x02d80000
allocation_type: 12289 (MEM_COMMIT|MEM_RESERVE)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2784
region_size: 143360
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x02ea0000
allocation_type: 12289 (MEM_COMMIT|MEM_RESERVE)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2784
region_size: 143360
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x02f50000
allocation_type: 12289 (MEM_COMMIT|MEM_RESERVE)
process_handle: 0xffffffff
1 0 0
Time & API Arguments Status Return Repeated

NtProtectVirtualMemory

 process_identifier: 2784
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
length: 139264
protection: 32 (PAGE_EXECUTE_READ)
base_address: 0x00441000
process_handle: 0xffffffff
1 0 0
section {u'size_of_data': u'0x00025600', u'virtual_address': u'0x00061000', u'entropy': 7.918756252441924, u'name': u'.data', u'virtual_size': u'0x00029398'} entropy 7.91875625244 description A section with a high entropy has been found
entropy 0.243287225386 description Overall entropy of this PE file is high
process rundll32.exe
host 103.75.201.2
host 103.8.26.102
host 103.8.26.103
host 104.168.155.129
host 104.251.214.46
host 131.100.24.231
host 158.69.222.101
host 173.212.193.249
host 176.104.106.96
host 178.63.25.185
host 178.79.147.66
host 192.254.71.210
host 203.114.109.124
host 207.38.84.195
host 209.59.138.75
host 212.237.17.99
host 212.237.56.116
host 216.158.226.206
host 217.182.143.207
host 45.118.115.99
host 45.118.135.203
host 45.142.114.231
host 45.176.232.124
host 46.55.222.11
host 50.116.54.215
host 51.38.71.0
host 51.68.175.8
host 58.227.42.236
host 79.172.212.216
host 81.0.236.90
Elastic malicious (high confidence)
FireEye Generic.mg.af2501aafd182ef4
McAfee Emotet-FSY!AF2501AAFD18
Cylance Unsafe
K7AntiVirus Trojan ( 0058d5191 )
K7GW Trojan ( 0058d5191 )
Cyren W32/Emotet.EEL.gen!Eldorado
ESET-NOD32 a variant of Win32/Kryptik.HOBB
Kaspersky HEUR:Trojan.Win32.Mansabo.gen
McAfee-GW-Edition BehavesLike.Win32.Dropper.jh
SentinelOne Static AI - Suspicious PE
Microsoft Trojan:Win32/Wacatac.B!ml
Cynet Malicious (score: 100)
AhnLab-V3 Trojan/Win.Emotet.R467259
VBA32 BScope.Trojan.Dovs
Malwarebytes Trojan.Emotet
APEX Malicious
Rising Trojan.Kryptik!8.8 (C64:YzY0OiyNmCDlVI2j)
Panda Trj/GdSda.A
dead_host 192.168.56.101:49181
dead_host 212.237.17.99:8080
dead_host 192.168.56.101:49196
dead_host 192.168.56.101:49206
dead_host 217.182.143.207:443
dead_host 203.114.109.124:443
dead_host 81.0.236.90:443
dead_host 45.142.114.231:8080
dead_host 192.168.56.101:49180
dead_host 192.168.56.101:49203
dead_host 192.168.56.101:49210
dead_host 103.75.201.2:443
dead_host 178.63.25.185:443
dead_host 192.168.56.101:49197
dead_host 104.251.214.46:8080
dead_host 192.168.56.101:49207
dead_host 207.38.84.195:8080
dead_host 192.168.56.101:49216
dead_host 45.118.135.203:7080
dead_host 173.212.193.249:8080
dead_host 192.168.56.101:49208
dead_host 192.254.71.210:443
dead_host 192.168.56.101:49198
dead_host 176.104.106.96:8080
dead_host 45.118.115.99:8080
dead_host 192.168.56.101:49209
dead_host 178.79.147.66:8080
dead_host 192.168.56.101:49182
dead_host 45.176.232.124:443
dead_host 192.168.56.101:49213
dead_host 158.69.222.101:443
dead_host 212.237.56.116:7080
dead_host 58.227.42.236:80
dead_host 79.172.212.216:8080
dead_host 192.168.56.101:49187
dead_host 192.168.56.101:49205
dead_host 192.168.56.101:49214