Summary | ZeroBOX

Category	Machine	Started	Completed
FILE	s1_win7_x6401	May 19, 2022, 7:45 a.m.	May 19, 2022, 7:47 a.m.

Size	846.5KB
Type	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
MD5	`8ce5bbf21b9168bb3b3b3837e59bf581`
SHA256	`19b9abc2ed7abd32cb4cb155c95f68e8b120fcfba1cb0efb2beb9456c516109b`
CRC32	`2DE6C437`
ssdeep	`24576:sPMTg9U3G0ISDKvSeqfZaePWAy7VmpE3:BTg9UXRD2SeqfZZixm`
Yara	OS_Processor_Check_Zero - OS Processor Check UPX_Zero - UPX packed file IsDLL - (no description) Malicious_Library_Zero - Malicious_Library PE_Header_Zero - PE File Signature IsPE64 - (no description)

rundll32.exe "C:\Windows\System32\rundll32.exe" C:\Users\test22\AppData\Local\Temp\b4QyfcO.dll,DllRegisterServer
2792
- rundll32.exe "C:\Windows\System32\rundll32.exe" C:\Users\test22\AppData\Local\Temp\b4QyfcO.dll,DllRegisterServer
  2020
  - explorer.exe C:\Windows\Explorer.EXE
    1156
  - regsvr32.exe C:\Windows\system32\regsvr32.exe "C:\Windows\system32\KwFlrhqvOrKv\WhmGAABnCNdDPhE.dll"
    2572
rundll32.exe "C:\Windows\System32\rundll32.exe" C:\Users\test22\AppData\Local\Temp\b4QyfcO.dll,YAeJyEAYL7F4eDck6YUaf
2884
- rundll32.exe "C:\Windows\System32\rundll32.exe" C:\Users\test22\AppData\Local\Temp\b4QyfcO.dll,YAeJyEAYL7F4eDck6YUaf
  2228
rundll32.exe "C:\Windows\System32\rundll32.exe" C:\Users\test22\AppData\Local\Temp\b4QyfcO.dll,fmFkmnQYB5TC2Sq5NGFkK
2972
- rundll32.exe "C:\Windows\System32\rundll32.exe" C:\Users\test22\AppData\Local\Temp\b4QyfcO.dll,fmFkmnQYB5TC2Sq5NGFkK
  2240
rundll32.exe "C:\Windows\System32\rundll32.exe" C:\Users\test22\AppData\Local\Temp\b4QyfcO.dll,nrDjhnkd9nedaQwcCY
3064
- rundll32.exe "C:\Windows\System32\rundll32.exe" C:\Users\test22\AppData\Local\Temp\b4QyfcO.dll,nrDjhnkd9nedaQwcCY
  2384
rundll32.exe "C:\Windows\System32\rundll32.exe" C:\Users\test22\AppData\Local\Temp\b4QyfcO.dll,
2140

Name	Response	Post-Analysis Lookup
No hosts contacted.

IP Address	Status	Action
No hosts contacted.

Suricata Alerts

No Suricata Alerts

Suricata TLS

No Suricata TLS

Queries for the computername (1 event)

Time & API	Arguments	Status	Return	Repeated
GetComputerNameA May 19, 2022, 7:46 a.m.	computer_name: TEST22-PC	1	1	0

Checks if process is being debugged by a debugger (4 events)

Time & API	Arguments	Status	Return	Repeated
IsDebuggerPresent May 19, 2022, 7:39 a.m.			0	0
IsDebuggerPresent May 19, 2022, 7:39 a.m.			0	0
IsDebuggerPresent May 19, 2022, 7:39 a.m.			0	0
IsDebuggerPresent May 19, 2022, 7:39 a.m.			0	0

The executable contains unknown PE section names indicative of a packer (could be a false positive) (1 event)

section

_RDATA

One or more processes crashed (3 events)

Time & API	Arguments	Status
__exception__ May 19, 2022, 7:39 a.m.	stacktrace: exception.symbol: exception.exception_code: 0xc0000005 exception.address: 0x0 registers.r14: 6442450944 registers.r15: 0 registers.rcx: 6442642136 registers.rsi: 0 registers.r10: -72340172838076673 registers.rbx: 0 registers.rsp: 1832360 registers.r11: -9187201950435737472 registers.r8: 2736168 registers.r9: 10 registers.rdx: 8785163385496 registers.r12: 10 registers.rbp: 2736032 registers.rdi: 2736200 registers.rax: -1 registers.r13: 0	1
__exception__ May 19, 2022, 7:39 a.m.	stacktrace: exception.symbol: exception.exception_code: 0xc0000005 exception.address: 0x0 registers.r14: 6442450944 registers.r15: 0 registers.rcx: 6442642136 registers.rsi: 0 registers.r10: -72340172838076673 registers.rbx: 0 registers.rsp: 2029720 registers.r11: -9187201950435737472 registers.r8: 2670632 registers.r9: 10 registers.rdx: 8785163385440 registers.r12: 10 registers.rbp: 2670496 registers.rdi: 2670664 registers.rax: -1 registers.r13: 0	1
__exception__ May 19, 2022, 7:39 a.m.	stacktrace: exception.symbol: exception.exception_code: 0xc0000005 exception.address: 0x0 registers.r14: 6442450944 registers.r15: 0 registers.rcx: 6442642136 registers.rsi: 0 registers.r10: -72340172838076673 registers.rbx: 0 registers.rsp: 1768008 registers.r11: -9187201950435737472 registers.r8: 3719202 registers.r9: 10 registers.rdx: 8785163385416 registers.r12: 10 registers.rbp: 3719072 registers.rdi: 3719224 registers.rax: 1 registers.r13: 0	1

Allocates read-write-execute memory (usually to unpack itself) (23 events)

Time & API	Arguments	Status
NtAllocateVirtualMemory May 19, 2022, 7:37 a.m.	process_identifier: 2020 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0000000000560000 allocation_type: 12289 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory May 19, 2022, 7:39 a.m.	process_identifier: 2020 region_size: 192512 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0000000000570000 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory May 19, 2022, 7:39 a.m.	process_identifier: 2020 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000000007391c000 process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory May 19, 2022, 7:37 a.m.	process_identifier: 2228 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0000000001c90000 allocation_type: 12289 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory May 19, 2022, 7:39 a.m.	process_identifier: 2228 region_size: 192512 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0000000001d30000 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory May 19, 2022, 7:39 a.m.	process_identifier: 2228 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000000007391c000 process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory May 19, 2022, 7:37 a.m.	process_identifier: 2240 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0000000001d10000 allocation_type: 12289 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory May 19, 2022, 7:39 a.m.	process_identifier: 2240 region_size: 192512 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0000000001d20000 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory May 19, 2022, 7:39 a.m.	process_identifier: 2240 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000000007391c000 process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory May 19, 2022, 7:37 a.m.	process_identifier: 2384 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0000000001c90000 allocation_type: 12289 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory May 19, 2022, 7:39 a.m.	process_identifier: 2384 region_size: 192512 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0000000001ca0000 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory May 19, 2022, 7:39 a.m.	process_identifier: 2384 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000000007391c000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory May 19, 2022, 7:46 a.m.	process_identifier: 2572 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fef48d1000 process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory May 19, 2022, 7:46 a.m.	process_identifier: 2572 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0000000001d10000 allocation_type: 12289 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory May 19, 2022, 7:46 a.m.	process_identifier: 2572 region_size: 192512 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0000000001d20000 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory May 19, 2022, 7:46 a.m.	process_identifier: 2572 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fefd2b7000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory May 19, 2022, 7:46 a.m.	process_identifier: 2572 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fefdbef000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory May 19, 2022, 7:46 a.m.	process_identifier: 2572 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fefd969000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory May 19, 2022, 7:46 a.m.	process_identifier: 2572 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 8192 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0000000077160000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory May 19, 2022, 7:46 a.m.	process_identifier: 2572 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007feff72d000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory May 19, 2022, 7:46 a.m.	process_identifier: 2572 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0000000076d9e000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory May 19, 2022, 7:46 a.m.	process_identifier: 2572 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00000000772f0000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory May 19, 2022, 7:46 a.m.	process_identifier: 2572 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fefbbba000 process_handle: 0xffffffffffffffff	1

Creates a suspicious process (1 event)

cmdline

C:\Windows\system32\regsvr32.exe "C:\Windows\system32\KwFlrhqvOrKv\WhmGAABnCNdDPhE.dll"

Searches running processes potentially to identify processes for sandbox evasion, code injection or memory dumping (1 event)

Time & API	Arguments	Status	Return	Repeated
Process32NextW May 19, 2022, 7:46 a.m.	snapshot_handle: 0x0000000000000148 process_name: rundll32.exe process_identifier: 2228	1	1	0

The binary likely contains encrypted or compressed data indicative of a packer (2 events)

section

{u'size_of_data': u'0x0002ec00', u'virtual_address': u'0x000a9000', u'entropy': 7.8141525822926, u'name': u'.rsrc', u'virtual_size': u'0x0002ea20'}

entropy

7.81415258229

description

A section with a high entropy has been found

entropy

0.22117090479

description

Overall entropy of this PE file is high

Expresses interest in specific running processes (1 event)

process

regsvr32.exe

Installs itself for autorun at Windows startup (1 event)

service_name

WhmGAABnCNdDPhE.dll

service_path

C:\Windows\System32\regsvr32.exe "C:\Windows\system32\KwFlrhqvOrKv\WhmGAABnCNdDPhE.dll"

Created a service where a service was also not started (1 event)

Time & API	Arguments	Status	Return	Repeated
CreateServiceW May 19, 2022, 7:39 a.m.	service_start_name: start_type: 2 password: display_name: WhmGAABnCNdDPhE.dll filepath: C:\Windows\System32\regsvr32.exe "C:\Windows\system32\KwFlrhqvOrKv\WhmGAABnCNdDPhE.dll" service_name: WhmGAABnCNdDPhE.dll filepath_r: C:\Windows\system32\regsvr32.exe "C:\Windows\system32\KwFlrhqvOrKv\WhmGAABnCNdDPhE.dll" desired_access: 2 service_handle: 0x0000000000351440 error_control: 0 service_type: 16 service_manager_handle: 0x0000000000368d70	1	3478592	0

File has been identified by 10 AntiVirus engines on VirusTotal as malicious (10 events)

FireEye	Generic.mg.8ce5bbf21b9168bb
McAfee	Emotet-FTN!8CE5BBF21B91
Elastic	malicious (high confidence)
Kaspersky	VHO:Trojan.Win32.Injuke.fmqg
Avast	TrojanX-gen [Trj]
McAfee-GW-Edition	BehavesLike.Win64.Generic.ch
Cynet	Malicious (score: 100)
Rising	Trojan.Injuke!8.10932 (C64:YzY0Ouqm/Xjjdpbm)
MaxSecure	Trojan.Malware.300983.susgen
AVG	TrojanX-gen [Trj]

Attempts to remove evidence of file being downloaded from the Internet (1 event)

file	C:\Windows\System32\KwFlrhqvOrKv\WhmGAABnCNdDPhE.dll:Zone.Identifier

b4QyfcO

Process Tree Toggle all

Network Toggle all

Suricata Toggle all

Suricata Alerts

Suricata TLS

Signatures Toggle All