Summary | ZeroBOX

Category	Machine	Started	Completed
FILE	s1_win7_x6401	May 19, 2022, 7:33 a.m.	May 19, 2022, 7:35 a.m.

Size	840.5KB
Type	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
MD5	`0780b69f46cb3f3e54ec89941f83967b`
SHA256	`d429bd9e03abf1de710a82f53282b2359b7c92739be16f5aba69befe6b4920fa`
CRC32	`CA3D6BCE`
ssdeep	`12288:J0iTg1PU3G0r96SDEL28tH/9OpeqDfFOezePWAef7osaIwXCzlalnryV:CiTg9U3G0ISDKvSeqf4aePWAy7eUst`
Yara	OS_Processor_Check_Zero - OS Processor Check UPX_Zero - UPX packed file IsDLL - (no description) Malicious_Library_Zero - Malicious_Library PE_Header_Zero - PE File Signature IsPE64 - (no description)

rundll32.exe "C:\Windows\System32\rundll32.exe" C:\Users\test22\AppData\Local\Temp\jkNQKmmMlZi.dll,DllRegisterServer
2844
- rundll32.exe "C:\Windows\System32\rundll32.exe" C:\Users\test22\AppData\Local\Temp\jkNQKmmMlZi.dll,DllRegisterServer
  2228
  - regsvr32.exe C:\Windows\system32\regsvr32.exe "C:\Windows\system32\XUYIPWAUbFyHD\gSnKUUaKXT.dll"
    2504
rundll32.exe "C:\Windows\System32\rundll32.exe" C:\Users\test22\AppData\Local\Temp\jkNQKmmMlZi.dll,fmFkmnQYB5TC2Sq5NGFkK
3028
- rundll32.exe "C:\Windows\System32\rundll32.exe" C:\Users\test22\AppData\Local\Temp\jkNQKmmMlZi.dll,fmFkmnQYB5TC2Sq5NGFkK
  2244
rundll32.exe "C:\Windows\System32\rundll32.exe" C:\Users\test22\AppData\Local\Temp\jkNQKmmMlZi.dll,nrDjhnkd9nedaQwcCY
2112
- rundll32.exe "C:\Windows\System32\rundll32.exe" C:\Users\test22\AppData\Local\Temp\jkNQKmmMlZi.dll,nrDjhnkd9nedaQwcCY
  196
rundll32.exe "C:\Windows\System32\rundll32.exe" C:\Users\test22\AppData\Local\Temp\jkNQKmmMlZi.dll,YAeJyEAYL7F4eDck6YUaf
2928
- rundll32.exe "C:\Windows\System32\rundll32.exe" C:\Users\test22\AppData\Local\Temp\jkNQKmmMlZi.dll,YAeJyEAYL7F4eDck6YUaf
  2400
rundll32.exe "C:\Windows\System32\rundll32.exe" C:\Users\test22\AppData\Local\Temp\jkNQKmmMlZi.dll,
2188
explorer.exe C:\Windows\Explorer.EXE
1156

Name	Response	Post-Analysis Lookup
No hosts contacted.

IP Address	Status	Action
164.124.101.2	Active	Moloch

Suricata Alerts

No Suricata Alerts

Suricata TLS

No Suricata TLS

Queries for the computername (1 event)

Time & API	Arguments	Status	Return	Repeated
GetComputerNameA May 19, 2022, 7:35 a.m.	computer_name: TEST22-PC	1	1	0

Checks if process is being debugged by a debugger (4 events)

Time & API	Arguments	Status	Return	Repeated
IsDebuggerPresent May 19, 2022, 7:34 a.m.			0	0
IsDebuggerPresent May 19, 2022, 7:34 a.m.			0	0
IsDebuggerPresent May 19, 2022, 7:34 a.m.			0	0
IsDebuggerPresent May 19, 2022, 7:34 a.m.			0	0

The executable contains unknown PE section names indicative of a packer (could be a false positive) (1 event)

section

_RDATA

One or more processes crashed (3 events)

Time & API	Arguments	Status
__exception__ May 19, 2022, 7:34 a.m.	stacktrace: exception.symbol: exception.exception_code: 0xc0000005 exception.address: 0x0 registers.r14: 6442450944 registers.r15: 0 registers.rcx: 6442633896 registers.rsi: 0 registers.r10: -72340172838076673 registers.rbx: 0 registers.rsp: 1702936 registers.r11: -9187201950435737472 registers.r8: 3326032 registers.r9: 10 registers.rdx: 8785163000464 registers.r12: 10 registers.rbp: 3325888 registers.rdi: 3326056 registers.rax: -1 registers.r13: 0	1
__exception__ May 19, 2022, 7:34 a.m.	stacktrace: exception.symbol: exception.exception_code: 0xc0000005 exception.address: 0x0 registers.r14: 6442450944 registers.r15: 0 registers.rcx: 6442633896 registers.rsi: 0 registers.r10: -72340172838076673 registers.rbx: 0 registers.rsp: 2160552 registers.r11: -9187201950435737472 registers.r8: 4112464 registers.r9: 10 registers.rdx: 8785163000520 registers.r12: 10 registers.rbp: 4112320 registers.rdi: 4112488 registers.rax: -1 registers.r13: 0	1
__exception__ May 19, 2022, 7:34 a.m.	stacktrace: exception.symbol: exception.exception_code: 0xc0000005 exception.address: 0x0 registers.r14: 6442450944 registers.r15: 0 registers.rcx: 6442633896 registers.rsi: 0 registers.r10: -72340172838076673 registers.rbx: 0 registers.rsp: 2095448 registers.r11: -9187201950435737472 registers.r8: 3915850 registers.r9: 10 registers.rdx: 8785163000440 registers.r12: 10 registers.rbp: 3915712 registers.rdi: 3915880 registers.rax: 1 registers.r13: 0	1

Allocates read-write-execute memory (usually to unpack itself) (23 events)

Time & API	Arguments	Status
NtAllocateVirtualMemory May 19, 2022, 7:33 a.m.	process_identifier: 2244 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0000000001c20000 allocation_type: 12289 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory May 19, 2022, 7:34 a.m.	process_identifier: 2244 region_size: 184320 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0000000001c30000 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory May 19, 2022, 7:34 a.m.	process_identifier: 2244 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000000007391c000 process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory May 19, 2022, 7:33 a.m.	process_identifier: 2228 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0000000001c20000 allocation_type: 12289 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory May 19, 2022, 7:34 a.m.	process_identifier: 2228 region_size: 184320 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0000000001cc0000 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory May 19, 2022, 7:34 a.m.	process_identifier: 2228 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000000007391c000 process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory May 19, 2022, 7:33 a.m.	process_identifier: 2400 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0000000001c20000 allocation_type: 12289 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory May 19, 2022, 7:34 a.m.	process_identifier: 2400 region_size: 184320 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0000000001c30000 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory May 19, 2022, 7:34 a.m.	process_identifier: 2400 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000000007391c000 process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory May 19, 2022, 7:33 a.m.	process_identifier: 196 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0000000001c20000 allocation_type: 12289 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory May 19, 2022, 7:34 a.m.	process_identifier: 196 region_size: 184320 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0000000001c30000 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory May 19, 2022, 7:34 a.m.	process_identifier: 196 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000000007391c000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory May 19, 2022, 7:34 a.m.	process_identifier: 2504 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fef4871000 process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory May 19, 2022, 7:34 a.m.	process_identifier: 2504 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00000000004d0000 allocation_type: 12289 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory May 19, 2022, 7:35 a.m.	process_identifier: 2504 region_size: 184320 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0000000001d40000 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory May 19, 2022, 7:35 a.m.	process_identifier: 2504 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fefd2b7000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory May 19, 2022, 7:35 a.m.	process_identifier: 2504 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fefdbef000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory May 19, 2022, 7:35 a.m.	process_identifier: 2504 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fefd969000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory May 19, 2022, 7:35 a.m.	process_identifier: 2504 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 8192 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0000000077160000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory May 19, 2022, 7:35 a.m.	process_identifier: 2504 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007feff72d000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory May 19, 2022, 7:35 a.m.	process_identifier: 2504 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0000000076d9e000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory May 19, 2022, 7:35 a.m.	process_identifier: 2504 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00000000772f0000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory May 19, 2022, 7:35 a.m.	process_identifier: 2504 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fefbbba000 process_handle: 0xffffffffffffffff	1

Creates a suspicious process (1 event)

cmdline

C:\Windows\system32\regsvr32.exe "C:\Windows\system32\XUYIPWAUbFyHD\gSnKUUaKXT.dll"

Searches running processes potentially to identify processes for sandbox evasion, code injection or memory dumping (3 events)

Time & API	Arguments	Status	Return
Process32NextW May 19, 2022, 7:35 a.m.	snapshot_handle: 0x0000000000000148 process_name: rundll32.exe process_identifier: 2928	1	1
Process32NextW May 19, 2022, 7:35 a.m.	snapshot_handle: 0x0000000000000148 process_name: rundll32.exe process_identifier: 3028	1	1
Process32NextW May 19, 2022, 7:35 a.m.	snapshot_handle: 0x0000000000000148 process_name: svchost.exe process_identifier: 2024	1	1

The binary likely contains encrypted or compressed data indicative of a packer (2 events)

section

{u'size_of_data': u'0x0002d400', u'virtual_address': u'0x000a9000', u'entropy': 7.854826560429489, u'name': u'.rsrc', u'virtual_size': u'0x0002d220'}

entropy

7.85482656043

description

A section with a high entropy has been found

entropy

0.215604526504

description

Overall entropy of this PE file is high

Expresses interest in specific running processes (1 event)

process

regsvr32.exe

Installs itself for autorun at Windows startup (1 event)

service_name

gSnKUUaKXT.dll

service_path

C:\Windows\System32\regsvr32.exe "C:\Windows\system32\XUYIPWAUbFyHD\gSnKUUaKXT.dll"

Created a service where a service was also not started (1 event)

Time & API	Arguments	Status	Return	Repeated
CreateServiceW May 19, 2022, 7:34 a.m.	service_start_name: start_type: 2 password: display_name: gSnKUUaKXT.dll filepath: C:\Windows\System32\regsvr32.exe "C:\Windows\system32\XUYIPWAUbFyHD\gSnKUUaKXT.dll" service_name: gSnKUUaKXT.dll filepath_r: C:\Windows\system32\regsvr32.exe "C:\Windows\system32\XUYIPWAUbFyHD\gSnKUUaKXT.dll" desired_access: 2 service_handle: 0x000000000028cf20 error_control: 0 service_type: 16 service_manager_handle: 0x00000000002731e0	1	2674464	0

Attempts to remove evidence of file being downloaded from the Internet (1 event)

file	C:\Windows\System32\XUYIPWAUbFyHD\gSnKUUaKXT.dll:Zone.Identifier

jkNQKmmMlZi

Process Tree Toggle all

Network Toggle all

Suricata Toggle all

Suricata Alerts

Suricata TLS

Signatures Toggle All