Summary | ZeroBOX

Category	Machine	Started	Completed
FILE	s1_win7_x6401	May 19, 2022, 7:38 a.m.	May 19, 2022, 7:40 a.m.

Size	846.5KB
Type	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
MD5	`03549b52a58de0a96adde709c8434eb2`
SHA256	`47b0e99f7a053531563735cd386dd90951757490a52deb668d710271ab2ea061`
CRC32	`1FE0BB4C`
ssdeep	`24576:sPMTg9U3G0ISDKvSeqfZaePWAy7zmpE3:BTg9UXRD2SeqfZZi3m`
Yara	OS_Processor_Check_Zero - OS Processor Check UPX_Zero - UPX packed file IsDLL - (no description) Malicious_Library_Zero - Malicious_Library PE_Header_Zero - PE File Signature IsPE64 - (no description)

rundll32.exe "C:\Windows\System32\rundll32.exe" C:\Users\test22\AppData\Local\Temp\0AEt8wRWroIJmVgEjZC.dll,DllRegisterServer
2852
- rundll32.exe "C:\Windows\System32\rundll32.exe" C:\Users\test22\AppData\Local\Temp\0AEt8wRWroIJmVgEjZC.dll,DllRegisterServer
  2268
  - regsvr32.exe C:\Windows\system32\regsvr32.exe "C:\Windows\system32\NXkQQNrfYYSIrx\UUQQdGYnSe.dll"
    2864
rundll32.exe "C:\Windows\System32\rundll32.exe" C:\Users\test22\AppData\Local\Temp\0AEt8wRWroIJmVgEjZC.dll,YAeJyEAYL7F4eDck6YUaf
2936
- rundll32.exe "C:\Windows\System32\rundll32.exe" C:\Users\test22\AppData\Local\Temp\0AEt8wRWroIJmVgEjZC.dll,YAeJyEAYL7F4eDck6YUaf
  2288
rundll32.exe "C:\Windows\System32\rundll32.exe" C:\Users\test22\AppData\Local\Temp\0AEt8wRWroIJmVgEjZC.dll,fmFkmnQYB5TC2Sq5NGFkK
3028
- rundll32.exe "C:\Windows\System32\rundll32.exe" C:\Users\test22\AppData\Local\Temp\0AEt8wRWroIJmVgEjZC.dll,fmFkmnQYB5TC2Sq5NGFkK
  2404
rundll32.exe "C:\Windows\System32\rundll32.exe" C:\Users\test22\AppData\Local\Temp\0AEt8wRWroIJmVgEjZC.dll,nrDjhnkd9nedaQwcCY
2128
- rundll32.exe "C:\Windows\System32\rundll32.exe" C:\Users\test22\AppData\Local\Temp\0AEt8wRWroIJmVgEjZC.dll,nrDjhnkd9nedaQwcCY
  2448
rundll32.exe "C:\Windows\System32\rundll32.exe" C:\Users\test22\AppData\Local\Temp\0AEt8wRWroIJmVgEjZC.dll,
2180
explorer.exe C:\Windows\Explorer.EXE
1156

Name	Response	Post-Analysis Lookup
No hosts contacted.

IP Address	Status	Action
103.8.26.17	Active	Moloch
164.124.101.2	Active	Moloch

Suricata Alerts

No Suricata Alerts

Suricata TLS

No Suricata TLS

Queries for the computername (1 event)

Time & API	Arguments	Status	Return	Repeated
GetComputerNameA May 19, 2022, 7:40 a.m.	computer_name: TEST22-PC	1	1	0

Checks if process is being debugged by a debugger (4 events)

Time & API	Arguments	Status	Return	Repeated
IsDebuggerPresent May 19, 2022, 7:32 a.m.			0	0
IsDebuggerPresent May 19, 2022, 7:32 a.m.			0	0
IsDebuggerPresent May 19, 2022, 7:32 a.m.			0	0
IsDebuggerPresent May 19, 2022, 7:32 a.m.			0	0

The executable contains unknown PE section names indicative of a packer (could be a false positive) (1 event)

section

_RDATA

One or more processes crashed (3 events)

Time & API	Arguments	Status
__exception__ May 19, 2022, 7:32 a.m.	stacktrace: exception.symbol: exception.exception_code: 0xc0000005 exception.address: 0x0 registers.r14: 6442450944 registers.r15: 0 registers.rcx: 6442642136 registers.rsi: 0 registers.r10: -72340172838076673 registers.rbx: 0 registers.rsp: 1440536 registers.r11: -9187201950435737472 registers.r8: 1753216 registers.r9: 10 registers.rdx: 8785163909784 registers.r12: 10 registers.rbp: 1753056 registers.rdi: 1753240 registers.rax: -1 registers.r13: 0	1
__exception__ May 19, 2022, 7:32 a.m.	stacktrace: exception.symbol: exception.exception_code: 0xc0000005 exception.address: 0x0 registers.r14: 6442450944 registers.r15: 0 registers.rcx: 6442642136 registers.rsi: 0 registers.r10: -72340172838076673 registers.rbx: 0 registers.rsp: 2620168 registers.r11: -9187201950435737472 registers.r8: 3522688 registers.r9: 10 registers.rdx: 8785163909728 registers.r12: 10 registers.rbp: 3522528 registers.rdi: 3522712 registers.rax: -1 registers.r13: 0	1
__exception__ May 19, 2022, 7:32 a.m.	stacktrace: exception.symbol: exception.exception_code: 0xc0000005 exception.address: 0x0 registers.r14: 6442450944 registers.r15: 0 registers.rcx: 6442642136 registers.rsi: 0 registers.r10: -72340172838076673 registers.rbx: 0 registers.rsp: 784920 registers.r11: -9187201950435737472 registers.r8: 2277466 registers.r9: 10 registers.rdx: 8785163909704 registers.r12: 10 registers.rbp: 2277312 registers.rdi: 2277496 registers.rax: 1 registers.r13: 0	1

Allocates read-write-execute memory (usually to unpack itself) (23 events)

Time & API	Arguments	Status
NtAllocateVirtualMemory May 19, 2022, 7:31 a.m.	process_identifier: 2268 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0000000001ca0000 allocation_type: 12289 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory May 19, 2022, 7:32 a.m.	process_identifier: 2268 region_size: 192512 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0000000001cb0000 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory May 19, 2022, 7:32 a.m.	process_identifier: 2268 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000000007391c000 process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory May 19, 2022, 7:31 a.m.	process_identifier: 2288 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0000000001c20000 allocation_type: 12289 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory May 19, 2022, 7:32 a.m.	process_identifier: 2288 region_size: 192512 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0000000001c30000 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory May 19, 2022, 7:32 a.m.	process_identifier: 2288 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000000007391c000 process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory May 19, 2022, 7:31 a.m.	process_identifier: 2404 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0000000001c20000 allocation_type: 12289 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory May 19, 2022, 7:32 a.m.	process_identifier: 2404 region_size: 192512 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0000000001c30000 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory May 19, 2022, 7:32 a.m.	process_identifier: 2404 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000000007391c000 process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory May 19, 2022, 7:31 a.m.	process_identifier: 2448 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0000000001c20000 allocation_type: 12289 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory May 19, 2022, 7:32 a.m.	process_identifier: 2448 region_size: 192512 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0000000001cb0000 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory May 19, 2022, 7:32 a.m.	process_identifier: 2448 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000000007391c000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory May 19, 2022, 7:39 a.m.	process_identifier: 2864 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fef4951000 process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory May 19, 2022, 7:39 a.m.	process_identifier: 2864 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0000000001d10000 allocation_type: 12289 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory May 19, 2022, 7:40 a.m.	process_identifier: 2864 region_size: 192512 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0000000001d20000 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory May 19, 2022, 7:40 a.m.	process_identifier: 2864 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fefd2b7000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory May 19, 2022, 7:40 a.m.	process_identifier: 2864 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fefdbef000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory May 19, 2022, 7:40 a.m.	process_identifier: 2864 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fefd969000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory May 19, 2022, 7:40 a.m.	process_identifier: 2864 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 8192 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0000000077160000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory May 19, 2022, 7:40 a.m.	process_identifier: 2864 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007feff72d000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory May 19, 2022, 7:40 a.m.	process_identifier: 2864 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0000000076d9e000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory May 19, 2022, 7:40 a.m.	process_identifier: 2864 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00000000772f0000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory May 19, 2022, 7:40 a.m.	process_identifier: 2864 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fefbbba000 process_handle: 0xffffffffffffffff	1

Creates a suspicious process (1 event)

cmdline

C:\Windows\system32\regsvr32.exe "C:\Windows\system32\NXkQQNrfYYSIrx\UUQQdGYnSe.dll"

Searches running processes potentially to identify processes for sandbox evasion, code injection or memory dumping (1 event)

Time & API	Arguments	Status	Return	Repeated
Process32NextW May 19, 2022, 7:40 a.m.	snapshot_handle: 0x0000000000000148 process_name: taskhost.exe process_identifier: 2652	1	1	0

The binary likely contains encrypted or compressed data indicative of a packer (2 events)

section

{u'size_of_data': u'0x0002ec00', u'virtual_address': u'0x000a9000', u'entropy': 7.8141525822926, u'name': u'.rsrc', u'virtual_size': u'0x0002ea20'}

entropy

7.81415258229

description

A section with a high entropy has been found

entropy

0.22117090479

description

Overall entropy of this PE file is high

Expresses interest in specific running processes (1 event)

process

regsvr32.exe

Communicates with host for which no DNS query was performed (1 event)

host

103.8.26.17

Installs itself for autorun at Windows startup (1 event)

service_name

UUQQdGYnSe.dll

service_path

C:\Windows\System32\regsvr32.exe "C:\Windows\system32\NXkQQNrfYYSIrx\UUQQdGYnSe.dll"

Created a service where a service was also not started (1 event)

Time & API	Arguments	Status	Return	Repeated
CreateServiceW May 19, 2022, 7:32 a.m.	service_start_name: start_type: 2 password: display_name: UUQQdGYnSe.dll filepath: C:\Windows\System32\regsvr32.exe "C:\Windows\system32\NXkQQNrfYYSIrx\UUQQdGYnSe.dll" service_name: UUQQdGYnSe.dll filepath_r: C:\Windows\system32\regsvr32.exe "C:\Windows\system32\NXkQQNrfYYSIrx\UUQQdGYnSe.dll" desired_access: 2 service_handle: 0x0000000000331c20 error_control: 0 service_type: 16 service_manager_handle: 0x0000000000347050	1	3349536	0

Attempts to remove evidence of file being downloaded from the Internet (1 event)

file	C:\Windows\System32\NXkQQNrfYYSIrx\UUQQdGYnSe.dll:Zone.Identifier

0AEt8wRWroIJmVgEjZC

Process Tree Toggle all

Network Toggle all

Suricata Toggle all

Suricata Alerts

Suricata TLS

Signatures Toggle All