Summary | ZeroBOX

Category	Machine	Started	Completed
FILE	s1_win7_x6401	May 19, 2022, 7:41 a.m.	May 19, 2022, 7:44 a.m.

Size	840.5KB
Type	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
MD5	`2feed60fc4a7069b6733d95239b300e2`
SHA256	`2d13b7ebc5bdcd17082d6d4717be7b0cd9edac0d3cf5a99981f4d650791569e7`
CRC32	`97187F51`
ssdeep	`12288:J0iTg1PU3G0r96SDEL28tH/9OpeqDfFOezePWAef7opaIwXCzlalnryV:CiTg9U3G0ISDKvSeqf4aePWAy79Ust`
Yara	OS_Processor_Check_Zero - OS Processor Check UPX_Zero - UPX packed file IsDLL - (no description) Malicious_Library_Zero - Malicious_Library PE_Header_Zero - PE File Signature IsPE64 - (no description)

rundll32.exe "C:\Windows\System32\rundll32.exe" C:\Users\test22\AppData\Local\Temp\12DtB7kP6Ur8X77.dll,DllRegisterServer
2784
- rundll32.exe "C:\Windows\System32\rundll32.exe" C:\Users\test22\AppData\Local\Temp\12DtB7kP6Ur8X77.dll,DllRegisterServer
  2136
  - regsvr32.exe C:\Windows\system32\regsvr32.exe "C:\Windows\system32\RrmissNJxG\kkfJuxIFLsdg.dll"
    572
rundll32.exe "C:\Windows\System32\rundll32.exe" C:\Users\test22\AppData\Local\Temp\12DtB7kP6Ur8X77.dll,YAeJyEAYL7F4eDck6YUaf
2876
- rundll32.exe "C:\Windows\System32\rundll32.exe" C:\Users\test22\AppData\Local\Temp\12DtB7kP6Ur8X77.dll,YAeJyEAYL7F4eDck6YUaf
  2244
rundll32.exe "C:\Windows\System32\rundll32.exe" C:\Users\test22\AppData\Local\Temp\12DtB7kP6Ur8X77.dll,fmFkmnQYB5TC2Sq5NGFkK
2968
- rundll32.exe "C:\Windows\System32\rundll32.exe" C:\Users\test22\AppData\Local\Temp\12DtB7kP6Ur8X77.dll,fmFkmnQYB5TC2Sq5NGFkK
  2104
rundll32.exe "C:\Windows\System32\rundll32.exe" C:\Users\test22\AppData\Local\Temp\12DtB7kP6Ur8X77.dll,nrDjhnkd9nedaQwcCY
3056
- rundll32.exe "C:\Windows\System32\rundll32.exe" C:\Users\test22\AppData\Local\Temp\12DtB7kP6Ur8X77.dll,nrDjhnkd9nedaQwcCY
  2332
rundll32.exe "C:\Windows\System32\rundll32.exe" C:\Users\test22\AppData\Local\Temp\12DtB7kP6Ur8X77.dll,
2144
explorer.exe C:\Windows\Explorer.EXE
1156

Name	Response	Post-Analysis Lookup
No hosts contacted.

IP Address	Status	Action
173.239.37.178	Active	Moloch
89.29.244.7	Active	Moloch

Suricata Alerts

Flow	SID	Signature	Category
TCP 192.168.56.101:49177 -> 173.239.37.178:8080	2028401	ET JA3 Hash - Possible Malware - Various Trickbot/Kovter/Dridex	Unknown Traffic
TCP 89.29.244.7:443 -> 192.168.56.101:49183	2029340	ET INFO TLS Handshake Failure	Potentially Bad Traffic
TCP 192.168.56.101:49181 -> 89.29.244.7:443	2028401	ET JA3 Hash - Possible Malware - Various Trickbot/Kovter/Dridex	Unknown Traffic
TCP 173.239.37.178:8080 -> 192.168.56.101:49179	2029340	ET INFO TLS Handshake Failure	Potentially Bad Traffic
TCP 192.168.56.101:49178 -> 173.239.37.178:8080	2028401	ET JA3 Hash - Possible Malware - Various Trickbot/Kovter/Dridex	Unknown Traffic
TCP 192.168.56.101:49182 -> 89.29.244.7:443	2028401	ET JA3 Hash - Possible Malware - Various Trickbot/Kovter/Dridex	Unknown Traffic

Suricata TLS

No Suricata TLS

Queries for the computername (1 event)

Time & API	Arguments	Status	Return	Repeated
GetComputerNameA May 19, 2022, 7:36 a.m.	computer_name: TEST22-PC	1	1	0

Checks if process is being debugged by a debugger (4 events)

Time & API	Arguments	Status	Return	Repeated
IsDebuggerPresent May 19, 2022, 7:43 a.m.			0	0
IsDebuggerPresent May 19, 2022, 7:43 a.m.			0	0
IsDebuggerPresent May 19, 2022, 7:43 a.m.			0	0
IsDebuggerPresent May 19, 2022, 7:43 a.m.			0	0

The executable contains unknown PE section names indicative of a packer (could be a false positive) (1 event)

section

_RDATA

One or more processes crashed (3 events)

Time & API	Arguments	Status
__exception__ May 19, 2022, 7:43 a.m.	stacktrace: exception.symbol: exception.exception_code: 0xc0000005 exception.address: 0x0 registers.r14: 6442450944 registers.r15: 0 registers.rcx: 6442633896 registers.rsi: 0 registers.r10: -72340172838076673 registers.rbx: 0 registers.rsp: 1636440 registers.r11: -9187201950435737472 registers.r8: 3194968 registers.r9: 10 registers.rdx: 8785163393680 registers.r12: 10 registers.rbp: 3194816 registers.rdi: 3195000 registers.rax: -1 registers.r13: 0	1
__exception__ May 19, 2022, 7:43 a.m.	stacktrace: exception.symbol: exception.exception_code: 0xc0000005 exception.address: 0x0 registers.r14: 6442450944 registers.r15: 0 registers.rcx: 6442633896 registers.rsi: 0 registers.r10: -72340172838076673 registers.rbx: 0 registers.rsp: 784920 registers.r11: -9187201950435737472 registers.r8: 2146392 registers.r9: 10 registers.rdx: 8785163393736 registers.r12: 10 registers.rbp: 2146240 registers.rdi: 2146424 registers.rax: -1 registers.r13: 0	1
__exception__ May 19, 2022, 7:43 a.m.	stacktrace: exception.symbol: exception.exception_code: 0xc0000005 exception.address: 0x0 registers.r14: 6442450944 registers.r15: 0 registers.rcx: 6442633896 registers.rsi: 0 registers.r10: -72340172838076673 registers.rbx: 0 registers.rsp: 2553224 registers.r11: -9187201950435737472 registers.r8: 966738 registers.r9: 10 registers.rdx: 8785163393656 registers.r12: 10 registers.rbp: 966592 registers.rdi: 966760 registers.rax: 1 registers.r13: 0	1

Allocates read-write-execute memory (usually to unpack itself) (23 events)

Time & API	Arguments	Status
NtAllocateVirtualMemory May 19, 2022, 7:41 a.m.	process_identifier: 2136 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0000000001c20000 allocation_type: 12289 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory May 19, 2022, 7:43 a.m.	process_identifier: 2136 region_size: 184320 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0000000001c30000 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory May 19, 2022, 7:43 a.m.	process_identifier: 2136 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000000007391c000 process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory May 19, 2022, 7:41 a.m.	process_identifier: 2104 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0000000001ca0000 allocation_type: 12289 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory May 19, 2022, 7:43 a.m.	process_identifier: 2104 region_size: 184320 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0000000001cb0000 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory May 19, 2022, 7:43 a.m.	process_identifier: 2104 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000000007391c000 process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory May 19, 2022, 7:41 a.m.	process_identifier: 2244 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0000000001c20000 allocation_type: 12289 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory May 19, 2022, 7:43 a.m.	process_identifier: 2244 region_size: 184320 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0000000001c30000 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory May 19, 2022, 7:43 a.m.	process_identifier: 2244 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000000007391c000 process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory May 19, 2022, 7:41 a.m.	process_identifier: 2332 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0000000001c20000 allocation_type: 12289 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory May 19, 2022, 7:43 a.m.	process_identifier: 2332 region_size: 184320 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0000000001c30000 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory May 19, 2022, 7:43 a.m.	process_identifier: 2332 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000000007391c000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory May 19, 2022, 7:35 a.m.	process_identifier: 572 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fef48d1000 process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory May 19, 2022, 7:35 a.m.	process_identifier: 572 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0000000001df0000 allocation_type: 12289 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory May 19, 2022, 7:36 a.m.	process_identifier: 572 region_size: 184320 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0000000001e00000 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory May 19, 2022, 7:36 a.m.	process_identifier: 572 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fefd2b7000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory May 19, 2022, 7:36 a.m.	process_identifier: 572 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fefdbef000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory May 19, 2022, 7:36 a.m.	process_identifier: 572 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fefd969000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory May 19, 2022, 7:36 a.m.	process_identifier: 572 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 8192 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0000000077160000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory May 19, 2022, 7:36 a.m.	process_identifier: 572 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007feff72d000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory May 19, 2022, 7:36 a.m.	process_identifier: 572 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0000000076d9e000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory May 19, 2022, 7:36 a.m.	process_identifier: 572 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00000000772f0000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory May 19, 2022, 7:36 a.m.	process_identifier: 572 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fefbbba000 process_handle: 0xffffffffffffffff	1

Creates a suspicious process (1 event)

cmdline

C:\Windows\system32\regsvr32.exe "C:\Windows\system32\RrmissNJxG\kkfJuxIFLsdg.dll"

Searches running processes potentially to identify processes for sandbox evasion, code injection or memory dumping (1 event)

Time & API	Arguments	Status	Return	Repeated
Process32NextW May 19, 2022, 7:36 a.m.	snapshot_handle: 0x0000000000000148 process_name: regsvr32.exe process_identifier: 572	1	1	0

The binary likely contains encrypted or compressed data indicative of a packer (2 events)

section

{u'size_of_data': u'0x0002d400', u'virtual_address': u'0x000a9000', u'entropy': 7.854826560429489, u'name': u'.rsrc', u'virtual_size': u'0x0002d220'}

entropy

7.85482656043

description

A section with a high entropy has been found

entropy

0.215604526504

description

Overall entropy of this PE file is high

Expresses interest in specific running processes (1 event)

process

regsvr32.exe

Communicates with host for which no DNS query was performed (2 events)

host	173.239.37.178
host	89.29.244.7

Installs itself for autorun at Windows startup (1 event)

service_name

kkfJuxIFLsdg.dll

service_path

C:\Windows\System32\regsvr32.exe "C:\Windows\system32\RrmissNJxG\kkfJuxIFLsdg.dll"

Created a service where a service was also not started (1 event)

Time & API	Arguments	Status	Return	Repeated
CreateServiceW May 19, 2022, 7:43 a.m.	service_start_name: start_type: 2 password: display_name: kkfJuxIFLsdg.dll filepath: C:\Windows\System32\regsvr32.exe "C:\Windows\system32\RrmissNJxG\kkfJuxIFLsdg.dll" service_name: kkfJuxIFLsdg.dll filepath_r: C:\Windows\system32\regsvr32.exe "C:\Windows\system32\RrmissNJxG\kkfJuxIFLsdg.dll" desired_access: 2 service_handle: 0x00000000003c51b0 error_control: 0 service_type: 16 service_manager_handle: 0x00000000003c5180	1	3953072	0

Creates a windows hook that monitors keyboard input (keylogger) (1 event)

Time & API	Arguments	Status	Return	Repeated
SetWindowsHookExW May 19, 2022, 7:36 a.m.	thread_identifier: 0 callback_function: 0x00000000ff8cae10 hook_identifier: 13 (WH_KEYBOARD_LL) module_address: 0x00000000ff820000	1	328135	0

Attempts to remove evidence of file being downloaded from the Internet (1 event)

file	C:\Windows\System32\RrmissNJxG\kkfJuxIFLsdg.dll:Zone.Identifier

12DtB7kP6Ur8X77

Process Tree Toggle all

Network Toggle all

Suricata Toggle all

Suricata Alerts

Suricata TLS

Signatures Toggle All