Summary | ZeroBOX

Category	Machine	Started	Completed
FILE	s1_win7_x6401	July 8, 2022, 8:21 p.m.	July 8, 2022, 8:23 p.m.

Size	278.0KB
Type	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
MD5	`88fcb7e4f43e8a1c3eaac09cd1b6e421`
SHA256	`a20782c217400811bc1777c2caa661114faecda0680bf9d3145c2573ca685bd9`
CRC32	`77EFFD07`
ssdeep	`6144:H8aVTnVgc9YT4Xf+WXv8cMkjdF4r6UrjCxGNh3XlwfjR96:H8wTV7owHXvJMmdCrvrjZA3`
Yara	IsDLL - (no description) Malicious_Library_Zero - Malicious_Library UPX_Zero - UPX packed file PE_Header_Zero - PE File Signature IsPE64 - (no description)

rundll32.exe "C:\Windows\System32\rundll32.exe" C:\Users\test22\AppData\Local\Temp\9dwcb1g2Vqh3Owz.dll,AjkRVrFNnyQmqXQdrComyaiwV
2752
- rundll32.exe "C:\Windows\System32\rundll32.exe" C:\Users\test22\AppData\Local\Temp\9dwcb1g2Vqh3Owz.dll,AjkRVrFNnyQmqXQdrComyaiwV
  2264
rundll32.exe "C:\Windows\System32\rundll32.exe" C:\Users\test22\AppData\Local\Temp\9dwcb1g2Vqh3Owz.dll,AkMhEGvNFpnSswjeCw
2856
- rundll32.exe "C:\Windows\System32\rundll32.exe" C:\Users\test22\AppData\Local\Temp\9dwcb1g2Vqh3Owz.dll,AkMhEGvNFpnSswjeCw
  2284
rundll32.exe "C:\Windows\System32\rundll32.exe" C:\Users\test22\AppData\Local\Temp\9dwcb1g2Vqh3Owz.dll,BMIWqtk
2948
- rundll32.exe "C:\Windows\System32\rundll32.exe" C:\Users\test22\AppData\Local\Temp\9dwcb1g2Vqh3Owz.dll,BMIWqtk
  2480
rundll32.exe "C:\Windows\System32\rundll32.exe" C:\Users\test22\AppData\Local\Temp\9dwcb1g2Vqh3Owz.dll,BpsBUyIiAmXYU
3036
- rundll32.exe "C:\Windows\System32\rundll32.exe" C:\Users\test22\AppData\Local\Temp\9dwcb1g2Vqh3Owz.dll,BpsBUyIiAmXYU
  2784
rundll32.exe "C:\Windows\System32\rundll32.exe" C:\Users\test22\AppData\Local\Temp\9dwcb1g2Vqh3Owz.dll,BxBybURSqJfOwVmXj
2116
- rundll32.exe "C:\Windows\System32\rundll32.exe" C:\Users\test22\AppData\Local\Temp\9dwcb1g2Vqh3Owz.dll,BxBybURSqJfOwVmXj
  2900
rundll32.exe "C:\Windows\System32\rundll32.exe" C:\Users\test22\AppData\Local\Temp\9dwcb1g2Vqh3Owz.dll,CCSLGUsdVtcCbfF
2180
- rundll32.exe "C:\Windows\System32\rundll32.exe" C:\Users\test22\AppData\Local\Temp\9dwcb1g2Vqh3Owz.dll,CCSLGUsdVtcCbfF
  2936
rundll32.exe "C:\Windows\System32\rundll32.exe" C:\Users\test22\AppData\Local\Temp\9dwcb1g2Vqh3Owz.dll,CWBdqFubMR
2396
- rundll32.exe "C:\Windows\System32\rundll32.exe" C:\Users\test22\AppData\Local\Temp\9dwcb1g2Vqh3Owz.dll,CWBdqFubMR
  3068
rundll32.exe "C:\Windows\System32\rundll32.exe" C:\Users\test22\AppData\Local\Temp\9dwcb1g2Vqh3Owz.dll,CbEceKaoQvfuhhIK
2692
- rundll32.exe "C:\Windows\System32\rundll32.exe" C:\Users\test22\AppData\Local\Temp\9dwcb1g2Vqh3Owz.dll,CbEceKaoQvfuhhIK
  2388
rundll32.exe "C:\Windows\System32\rundll32.exe" C:\Users\test22\AppData\Local\Temp\9dwcb1g2Vqh3Owz.dll,CcBDyidVYuvtjWfG
2980
- rundll32.exe "C:\Windows\System32\rundll32.exe" C:\Users\test22\AppData\Local\Temp\9dwcb1g2Vqh3Owz.dll,CcBDyidVYuvtjWfG
  2556
rundll32.exe "C:\Windows\System32\rundll32.exe" C:\Users\test22\AppData\Local\Temp\9dwcb1g2Vqh3Owz.dll,CeOVtVdkUnRPoUvswsvkEf
2172
- rundll32.exe "C:\Windows\System32\rundll32.exe" C:\Users\test22\AppData\Local\Temp\9dwcb1g2Vqh3Owz.dll,CeOVtVdkUnRPoUvswsvkEf
  2448
rundll32.exe "C:\Windows\System32\rundll32.exe" C:\Users\test22\AppData\Local\Temp\9dwcb1g2Vqh3Owz.dll,CvxIGiXAzAG
2604
- rundll32.exe "C:\Windows\System32\rundll32.exe" C:\Users\test22\AppData\Local\Temp\9dwcb1g2Vqh3Owz.dll,CvxIGiXAzAG
  900
rundll32.exe "C:\Windows\System32\rundll32.exe" C:\Users\test22\AppData\Local\Temp\9dwcb1g2Vqh3Owz.dll,DPsWXvFrrwOLZwoq
192
- rundll32.exe "C:\Windows\System32\rundll32.exe" C:\Users\test22\AppData\Local\Temp\9dwcb1g2Vqh3Owz.dll,DPsWXvFrrwOLZwoq
  316
rundll32.exe "C:\Windows\System32\rundll32.exe" C:\Users\test22\AppData\Local\Temp\9dwcb1g2Vqh3Owz.dll,DllRegisterServer
2780
- rundll32.exe "C:\Windows\System32\rundll32.exe" C:\Users\test22\AppData\Local\Temp\9dwcb1g2Vqh3Owz.dll,DllRegisterServer
  2796
  - regsvr32.exe C:\Windows\system32\regsvr32.exe "C:\Windows\system32\CzdBONwxxN\RuVOfPmjFdIf.dll"
    3904
rundll32.exe "C:\Windows\System32\rundll32.exe" C:\Users\test22\AppData\Local\Temp\9dwcb1g2Vqh3Owz.dll,ENtihcf
2560
- rundll32.exe "C:\Windows\System32\rundll32.exe" C:\Users\test22\AppData\Local\Temp\9dwcb1g2Vqh3Owz.dll,ENtihcf
  2832
rundll32.exe "C:\Windows\System32\rundll32.exe" C:\Users\test22\AppData\Local\Temp\9dwcb1g2Vqh3Owz.dll,EVYoaysfyVmedMKzqOkd
2740
- rundll32.exe "C:\Windows\System32\rundll32.exe" C:\Users\test22\AppData\Local\Temp\9dwcb1g2Vqh3Owz.dll,EVYoaysfyVmedMKzqOkd
  2304
rundll32.exe "C:\Windows\System32\rundll32.exe" C:\Users\test22\AppData\Local\Temp\9dwcb1g2Vqh3Owz.dll,FSgLIbzCJsGhKrdTRUhBnjq
2944
- rundll32.exe "C:\Windows\System32\rundll32.exe" C:\Users\test22\AppData\Local\Temp\9dwcb1g2Vqh3Owz.dll,FSgLIbzCJsGhKrdTRUhBnjq
  2952
rundll32.exe "C:\Windows\System32\rundll32.exe" C:\Users\test22\AppData\Local\Temp\9dwcb1g2Vqh3Owz.dll,FXswjNvwqEmJHSzKXfB
2964
- rundll32.exe "C:\Windows\System32\rundll32.exe" C:\Users\test22\AppData\Local\Temp\9dwcb1g2Vqh3Owz.dll,FXswjNvwqEmJHSzKXfB
  2344
rundll32.exe "C:\Windows\System32\rundll32.exe" C:\Users\test22\AppData\Local\Temp\9dwcb1g2Vqh3Owz.dll,FmRrLoGPniSXxeHYAaRXrsSIt
2100
- rundll32.exe "C:\Windows\System32\rundll32.exe" C:\Users\test22\AppData\Local\Temp\9dwcb1g2Vqh3Owz.dll,FmRrLoGPniSXxeHYAaRXrsSIt
  3176
rundll32.exe "C:\Windows\System32\rundll32.exe" C:\Users\test22\AppData\Local\Temp\9dwcb1g2Vqh3Owz.dll,FzYYWlRKDQMfKaJAUq
3236
- rundll32.exe "C:\Windows\System32\rundll32.exe" C:\Users\test22\AppData\Local\Temp\9dwcb1g2Vqh3Owz.dll,FzYYWlRKDQMfKaJAUq
  3396
explorer.exe C:\Windows\Explorer.EXE
1156
rundll32.exe "C:\Windows\System32\rundll32.exe" C:\Users\test22\AppData\Local\Temp\9dwcb1g2Vqh3Owz.dll,GEQqgSeWrJkaNSdjOw
3380
- rundll32.exe "C:\Windows\System32\rundll32.exe" C:\Users\test22\AppData\Local\Temp\9dwcb1g2Vqh3Owz.dll,GEQqgSeWrJkaNSdjOw
  3500
rundll32.exe "C:\Windows\System32\rundll32.exe" C:\Users\test22\AppData\Local\Temp\9dwcb1g2Vqh3Owz.dll,GLvPFjzv
3564
- rundll32.exe "C:\Windows\System32\rundll32.exe" C:\Users\test22\AppData\Local\Temp\9dwcb1g2Vqh3Owz.dll,GLvPFjzv
  3672
rundll32.exe "C:\Windows\System32\rundll32.exe" C:\Users\test22\AppData\Local\Temp\9dwcb1g2Vqh3Owz.dll,GTfYoyhXUmiOrfM
3664
rundll32.exe "C:\Windows\System32\rundll32.exe" C:\Users\test22\AppData\Local\Temp\9dwcb1g2Vqh3Owz.dll,GVTerofsGHUASHLhWfIFX
3796
rundll32.exe "C:\Windows\System32\rundll32.exe" C:\Users\test22\AppData\Local\Temp\9dwcb1g2Vqh3Owz.dll,GlLOHKioWJZCQPS
3896
rundll32.exe "C:\Windows\System32\rundll32.exe" C:\Users\test22\AppData\Local\Temp\9dwcb1g2Vqh3Owz.dll,GpqOdmj
4080
rundll32.exe "C:\Windows\System32\rundll32.exe" C:\Users\test22\AppData\Local\Temp\9dwcb1g2Vqh3Owz.dll,GtaEQGQNcgERZqWo
2240
rundll32.exe "C:\Windows\System32\rundll32.exe" C:\Users\test22\AppData\Local\Temp\9dwcb1g2Vqh3Owz.dll,GzdHPyIXWoMGb
3344
rundll32.exe "C:\Windows\System32\rundll32.exe" C:\Users\test22\AppData\Local\Temp\9dwcb1g2Vqh3Owz.dll,HKgdkPfboZzjQODFfSu
3452
rundll32.exe "C:\Windows\System32\rundll32.exe" C:\Users\test22\AppData\Local\Temp\9dwcb1g2Vqh3Owz.dll,HmXZBMEhrWvTg
3604
rundll32.exe "C:\Windows\System32\rundll32.exe" C:\Users\test22\AppData\Local\Temp\9dwcb1g2Vqh3Owz.dll,HvFWvy
3504
rundll32.exe "C:\Windows\System32\rundll32.exe" C:\Users\test22\AppData\Local\Temp\9dwcb1g2Vqh3Owz.dll,ICrKqnEJHHrxYaH
3960
rundll32.exe "C:\Windows\System32\rundll32.exe" C:\Users\test22\AppData\Local\Temp\9dwcb1g2Vqh3Owz.dll,IDENrF
2064
rundll32.exe "C:\Windows\System32\rundll32.exe" C:\Users\test22\AppData\Local\Temp\9dwcb1g2Vqh3Owz.dll,ISuniIBoqjzfv
3224
rundll32.exe "C:\Windows\System32\rundll32.exe" C:\Users\test22\AppData\Local\Temp\9dwcb1g2Vqh3Owz.dll,IcEiBSQQHwaxZGs
3432
rundll32.exe "C:\Windows\System32\rundll32.exe" C:\Users\test22\AppData\Local\Temp\9dwcb1g2Vqh3Owz.dll,JCFScdjDVMLKVa
3656
rundll32.exe "C:\Windows\System32\rundll32.exe" C:\Users\test22\AppData\Local\Temp\9dwcb1g2Vqh3Owz.dll,JGwGKVHFHwfxsyCIp
3888
rundll32.exe "C:\Windows\System32\rundll32.exe" C:\Users\test22\AppData\Local\Temp\9dwcb1g2Vqh3Owz.dll,JnkFkZthy
4072
rundll32.exe "C:\Windows\System32\rundll32.exe" C:\Users\test22\AppData\Local\Temp\9dwcb1g2Vqh3Owz.dll,LSRvMYckceDUkCMxwUAq
3208
rundll32.exe "C:\Windows\System32\rundll32.exe" C:\Users\test22\AppData\Local\Temp\9dwcb1g2Vqh3Owz.dll,LhZoEaJRggyJr
3700
rundll32.exe "C:\Windows\System32\rundll32.exe" C:\Users\test22\AppData\Local\Temp\9dwcb1g2Vqh3Owz.dll,MknuTlXosJJdvczIkg
3480
rundll32.exe "C:\Windows\System32\rundll32.exe" C:\Users\test22\AppData\Local\Temp\9dwcb1g2Vqh3Owz.dll,MrhDZxAutnSSobTVt
2920
rundll32.exe "C:\Windows\System32\rundll32.exe" C:\Users\test22\AppData\Local\Temp\9dwcb1g2Vqh3Owz.dll,NRfTvw
3984
rundll32.exe "C:\Windows\System32\rundll32.exe" C:\Users\test22\AppData\Local\Temp\9dwcb1g2Vqh3Owz.dll,NZDMYgNWoHhCVPBFWyuTBSesQ
2400
rundll32.exe "C:\Windows\System32\rundll32.exe" C:\Users\test22\AppData\Local\Temp\9dwcb1g2Vqh3Owz.dll,NmBmwe
4024
rundll32.exe "C:\Windows\System32\rundll32.exe" C:\Users\test22\AppData\Local\Temp\9dwcb1g2Vqh3Owz.dll,NzYPpUvQ
3092
rundll32.exe "C:\Windows\System32\rundll32.exe" C:\Users\test22\AppData\Local\Temp\9dwcb1g2Vqh3Owz.dll,OThzaIZTEfYKTCCRQlcnW
2572
rundll32.exe "C:\Windows\System32\rundll32.exe" C:\Users\test22\AppData\Local\Temp\9dwcb1g2Vqh3Owz.dll,OWMilsbkgGVyJL
4144
rundll32.exe "C:\Windows\System32\rundll32.exe" C:\Users\test22\AppData\Local\Temp\9dwcb1g2Vqh3Owz.dll,OguxguFiYSHz
4284
rundll32.exe "C:\Windows\System32\rundll32.exe" C:\Users\test22\AppData\Local\Temp\9dwcb1g2Vqh3Owz.dll,PHzWjRI
4420
rundll32.exe "C:\Windows\System32\rundll32.exe" C:\Users\test22\AppData\Local\Temp\9dwcb1g2Vqh3Owz.dll,PNJeVrAcZDAW
4520
rundll32.exe "C:\Windows\System32\rundll32.exe" C:\Users\test22\AppData\Local\Temp\9dwcb1g2Vqh3Owz.dll,PSDYwIgmLiVzYESIaUYrbKg
4636
rundll32.exe "C:\Windows\System32\rundll32.exe" C:\Users\test22\AppData\Local\Temp\9dwcb1g2Vqh3Owz.dll,PiJSThSmMmzNNC
4736
rundll32.exe "C:\Windows\System32\rundll32.exe" C:\Users\test22\AppData\Local\Temp\9dwcb1g2Vqh3Owz.dll,PneIJqdSVVerltCm
4864
rundll32.exe "C:\Windows\System32\rundll32.exe" C:\Users\test22\AppData\Local\Temp\9dwcb1g2Vqh3Owz.dll,PpsLezsCiHiCVkHmZP
4988
rundll32.exe "C:\Windows\System32\rundll32.exe" C:\Users\test22\AppData\Local\Temp\9dwcb1g2Vqh3Owz.dll,PuoUVwFKYxjCqT
5108
rundll32.exe "C:\Windows\System32\rundll32.exe" C:\Users\test22\AppData\Local\Temp\9dwcb1g2Vqh3Owz.dll,PwNlKX
4208
rundll32.exe "C:\Windows\System32\rundll32.exe" C:\Users\test22\AppData\Local\Temp\9dwcb1g2Vqh3Owz.dll,QRkaVvgiLqTCjGKy
4268
rundll32.exe "C:\Windows\System32\rundll32.exe" C:\Users\test22\AppData\Local\Temp\9dwcb1g2Vqh3Owz.dll,RJAcdfSthTv
4512
rundll32.exe "C:\Windows\System32\rundll32.exe" C:\Users\test22\AppData\Local\Temp\9dwcb1g2Vqh3Owz.dll,RYkwsDq
4676
rundll32.exe "C:\Windows\System32\rundll32.exe" C:\Users\test22\AppData\Local\Temp\9dwcb1g2Vqh3Owz.dll,RZtKxjO
4900
rundll32.exe "C:\Windows\System32\rundll32.exe" C:\Users\test22\AppData\Local\Temp\9dwcb1g2Vqh3Owz.dll,RcnQoaySRBXJxsiZQIHxe
5044
rundll32.exe "C:\Windows\System32\rundll32.exe" C:\Users\test22\AppData\Local\Temp\9dwcb1g2Vqh3Owz.dll,RdnXeofUSzEDgzxXeW
4240
rundll32.exe "C:\Windows\System32\rundll32.exe" C:\Users\test22\AppData\Local\Temp\9dwcb1g2Vqh3Owz.dll,RfsPQSmuvBYXfIScfOT
4492
rundll32.exe "C:\Windows\System32\rundll32.exe" C:\Users\test22\AppData\Local\Temp\9dwcb1g2Vqh3Owz.dll,RkfakVk
4664
rundll32.exe "C:\Windows\System32\rundll32.exe" C:\Users\test22\AppData\Local\Temp\9dwcb1g2Vqh3Owz.dll,RmhqixPgftgQ
4972
rundll32.exe "C:\Windows\System32\rundll32.exe" C:\Users\test22\AppData\Local\Temp\9dwcb1g2Vqh3Owz.dll,SInCoGYrouPZGmYYJGKIR
4260
rundll32.exe "C:\Windows\System32\rundll32.exe" C:\Users\test22\AppData\Local\Temp\9dwcb1g2Vqh3Owz.dll,SRXSueHCT
4564
rundll32.exe "C:\Windows\System32\rundll32.exe" C:\Users\test22\AppData\Local\Temp\9dwcb1g2Vqh3Owz.dll,SVlQsYSAXEyhEvVkdWdX
4860
rundll32.exe "C:\Windows\System32\rundll32.exe" C:\Users\test22\AppData\Local\Temp\9dwcb1g2Vqh3Owz.dll,SnLgFTA
3364
rundll32.exe "C:\Windows\System32\rundll32.exe" C:\Users\test22\AppData\Local\Temp\9dwcb1g2Vqh3Owz.dll,SxfQZPkEOIcG
4556
rundll32.exe "C:\Windows\System32\rundll32.exe" C:\Users\test22\AppData\Local\Temp\9dwcb1g2Vqh3Owz.dll,TJZCJgp
1308
rundll32.exe "C:\Windows\System32\rundll32.exe" C:\Users\test22\AppData\Local\Temp\9dwcb1g2Vqh3Owz.dll,TSNqZL
756
rundll32.exe "C:\Windows\System32\rundll32.exe" C:\Users\test22\AppData\Local\Temp\9dwcb1g2Vqh3Owz.dll,TfpEQJjWUDp
1588
rundll32.exe "C:\Windows\System32\rundll32.exe" C:\Users\test22\AppData\Local\Temp\9dwcb1g2Vqh3Owz.dll,TvUVDsEcInyvKdGRA
4856
rundll32.exe "C:\Windows\System32\rundll32.exe" C:\Users\test22\AppData\Local\Temp\9dwcb1g2Vqh3Owz.dll,TvtXyQtNShHDYCMvH
4756
rundll32.exe "C:\Windows\System32\rundll32.exe" C:\Users\test22\AppData\Local\Temp\9dwcb1g2Vqh3Owz.dll,UGXSNpc
1568
rundll32.exe "C:\Windows\System32\rundll32.exe" C:\Users\test22\AppData\Local\Temp\9dwcb1g2Vqh3Owz.dll,ULOMXGiV
4516
rundll32.exe "C:\Windows\System32\rundll32.exe" C:\Users\test22\AppData\Local\Temp\9dwcb1g2Vqh3Owz.dll,UVzHIeChKCEwTMG
5092
rundll32.exe "C:\Windows\System32\rundll32.exe" C:\Users\test22\AppData\Local\Temp\9dwcb1g2Vqh3Owz.dll,UagSsmENTltTUKpktiEuRJfE
5200
rundll32.exe "C:\Windows\System32\rundll32.exe" C:\Users\test22\AppData\Local\Temp\9dwcb1g2Vqh3Owz.dll,UbjFSQJG
5324
rundll32.exe "C:\Windows\System32\rundll32.exe" C:\Users\test22\AppData\Local\Temp\9dwcb1g2Vqh3Owz.dll,UjDfVglhgynLAuMpwrtpXkH
5432
rundll32.exe "C:\Windows\System32\rundll32.exe" C:\Users\test22\AppData\Local\Temp\9dwcb1g2Vqh3Owz.dll,UrxprELRNWbXXBuOJlJ
5544
rundll32.exe "C:\Windows\System32\rundll32.exe" C:\Users\test22\AppData\Local\Temp\9dwcb1g2Vqh3Owz.dll,VXDuMBzruSCyfbAMzIrvV
5652
rundll32.exe "C:\Windows\System32\rundll32.exe" C:\Users\test22\AppData\Local\Temp\9dwcb1g2Vqh3Owz.dll,VcrtEzpxSRmZr
5772
rundll32.exe "C:\Windows\System32\rundll32.exe" C:\Users\test22\AppData\Local\Temp\9dwcb1g2Vqh3Owz.dll,VkRjra
5896
rundll32.exe "C:\Windows\System32\rundll32.exe" C:\Users\test22\AppData\Local\Temp\9dwcb1g2Vqh3Owz.dll,WMxfpgNLwoiQTZjkM
5996
rundll32.exe "C:\Windows\System32\rundll32.exe" C:\Users\test22\AppData\Local\Temp\9dwcb1g2Vqh3Owz.dll,WjtCBeYwDkRZvKLfJD
6108
rundll32.exe "C:\Windows\System32\rundll32.exe" C:\Users\test22\AppData\Local\Temp\9dwcb1g2Vqh3Owz.dll,XoMiJXhdBRBldnkLkgMM
5236
rundll32.exe "C:\Windows\System32\rundll32.exe" C:\Users\test22\AppData\Local\Temp\9dwcb1g2Vqh3Owz.dll,XsBeDFcmOsaqRihqMytJ
5408
rundll32.exe "C:\Windows\System32\rundll32.exe" C:\Users\test22\AppData\Local\Temp\9dwcb1g2Vqh3Owz.dll,YGPQhuvjFbQXSoJfVilOnVw
5588
rundll32.exe "C:\Windows\System32\rundll32.exe" C:\Users\test22\AppData\Local\Temp\9dwcb1g2Vqh3Owz.dll,YvzKAJK
5744
rundll32.exe "C:\Windows\System32\rundll32.exe" C:\Users\test22\AppData\Local\Temp\9dwcb1g2Vqh3Owz.dll,ZAppiYnp
5940
rundll32.exe "C:\Windows\System32\rundll32.exe" C:\Users\test22\AppData\Local\Temp\9dwcb1g2Vqh3Owz.dll,ZXZEfUeKC
6024
rundll32.exe "C:\Windows\System32\rundll32.exe" C:\Users\test22\AppData\Local\Temp\9dwcb1g2Vqh3Owz.dll,ZoyjBLvuBnIxXaWxFC
6116
rundll32.exe "C:\Windows\System32\rundll32.exe" C:\Users\test22\AppData\Local\Temp\9dwcb1g2Vqh3Owz.dll,aZwlVZLRtCIfDmaYbAXR
5508
rundll32.exe "C:\Windows\System32\rundll32.exe" C:\Users\test22\AppData\Local\Temp\9dwcb1g2Vqh3Owz.dll,bdnAzUNoMZJXxzHG
5736
rundll32.exe "C:\Windows\System32\rundll32.exe" C:\Users\test22\AppData\Local\Temp\9dwcb1g2Vqh3Owz.dll,btmsIKQVm
5756
rundll32.exe "C:\Windows\System32\rundll32.exe" C:\Users\test22\AppData\Local\Temp\9dwcb1g2Vqh3Owz.dll,cFminOM
5128
rundll32.exe "C:\Windows\System32\rundll32.exe" C:\Users\test22\AppData\Local\Temp\9dwcb1g2Vqh3Owz.dll,cKjOEfqQYYQ
5696
rundll32.exe "C:\Windows\System32\rundll32.exe" C:\Users\test22\AppData\Local\Temp\9dwcb1g2Vqh3Owz.dll,czIvuAZ
5988
rundll32.exe "C:\Windows\System32\rundll32.exe" C:\Users\test22\AppData\Local\Temp\9dwcb1g2Vqh3Owz.dll,dMEJcsHSUiODu
5304
rundll32.exe "C:\Windows\System32\rundll32.exe" C:\Users\test22\AppData\Local\Temp\9dwcb1g2Vqh3Owz.dll,dPYgmMRi
5912
rundll32.exe "C:\Windows\System32\rundll32.exe" C:\Users\test22\AppData\Local\Temp\9dwcb1g2Vqh3Owz.dll,dStUmppUwHfwVxtCgCewXt
5144
rundll32.exe "C:\Windows\System32\rundll32.exe" C:\Users\test22\AppData\Local\Temp\9dwcb1g2Vqh3Owz.dll,deMXieymThIxfyWzHCMb
6032
rundll32.exe "C:\Windows\System32\rundll32.exe" C:\Users\test22\AppData\Local\Temp\9dwcb1g2Vqh3Owz.dll,dgCMMkwNpUNZ
2360
rundll32.exe "C:\Windows\System32\rundll32.exe" C:\Users\test22\AppData\Local\Temp\9dwcb1g2Vqh3Owz.dll,eDtAbxMTINFwGjIRymBKxBFTe
2372
rundll32.exe "C:\Windows\System32\rundll32.exe" C:\Users\test22\AppData\Local\Temp\9dwcb1g2Vqh3Owz.dll,ePfrWQkHuKqOV
5504
rundll32.exe "C:\Windows\System32\rundll32.exe" C:\Users\test22\AppData\Local\Temp\9dwcb1g2Vqh3Owz.dll,eQnPJdIEwUrOjHyYKajVY
6208
rundll32.exe "C:\Windows\System32\rundll32.exe" C:\Users\test22\AppData\Local\Temp\9dwcb1g2Vqh3Owz.dll,eWqtOcNgKbDEwKynrCTAaqRd
6312
rundll32.exe "C:\Windows\System32\rundll32.exe" C:\Users\test22\AppData\Local\Temp\9dwcb1g2Vqh3Owz.dll,eiRJXgFAjkyObQxtC
6428
rundll32.exe "C:\Windows\System32\rundll32.exe" C:\Users\test22\AppData\Local\Temp\9dwcb1g2Vqh3Owz.dll,fLsjxmtTmthGKPw
6552
rundll32.exe "C:\Windows\System32\rundll32.exe" C:\Users\test22\AppData\Local\Temp\9dwcb1g2Vqh3Owz.dll,fqsAeZLb
6656
rundll32.exe "C:\Windows\System32\rundll32.exe" C:\Users\test22\AppData\Local\Temp\9dwcb1g2Vqh3Owz.dll,frkkGhhTKCPBzCLoveBHn
6772
rundll32.exe "C:\Windows\System32\rundll32.exe" C:\Users\test22\AppData\Local\Temp\9dwcb1g2Vqh3Owz.dll,fxmvSQNzSiXj
6900
rundll32.exe "C:\Windows\System32\rundll32.exe" C:\Users\test22\AppData\Local\Temp\9dwcb1g2Vqh3Owz.dll,gATjvjWkzNfdmAJbeFMKFtUmoI
7024
rundll32.exe "C:\Windows\System32\rundll32.exe" C:\Users\test22\AppData\Local\Temp\9dwcb1g2Vqh3Owz.dll,gCFmNdxvaAq
7148
rundll32.exe "C:\Windows\System32\rundll32.exe" C:\Users\test22\AppData\Local\Temp\9dwcb1g2Vqh3Owz.dll,gfeRIwKkCZUnQQ
2212
rundll32.exe "C:\Windows\System32\rundll32.exe" C:\Users\test22\AppData\Local\Temp\9dwcb1g2Vqh3Owz.dll,gjZENXkR
6444
rundll32.exe "C:\Windows\System32\rundll32.exe" C:\Users\test22\AppData\Local\Temp\9dwcb1g2Vqh3Owz.dll,gzzlrzxMlshrI
6464
rundll32.exe "C:\Windows\System32\rundll32.exe" C:\Users\test22\AppData\Local\Temp\9dwcb1g2Vqh3Owz.dll,hClTxV
6788
rundll32.exe "C:\Windows\System32\rundll32.exe" C:\Users\test22\AppData\Local\Temp\9dwcb1g2Vqh3Owz.dll,hDdSABujeGhBdM
6944
rundll32.exe "C:\Windows\System32\rundll32.exe" C:\Users\test22\AppData\Local\Temp\9dwcb1g2Vqh3Owz.dll,hJbRrovBnfzadHBLOAaX
7132
rundll32.exe "C:\Windows\System32\rundll32.exe" C:\Users\test22\AppData\Local\Temp\9dwcb1g2Vqh3Owz.dll,hLNWWET
6288
rundll32.exe "C:\Windows\System32\rundll32.exe" C:\Users\test22\AppData\Local\Temp\9dwcb1g2Vqh3Owz.dll,iIJmtODVuCFQPMFae
6524
rundll32.exe "C:\Windows\System32\rundll32.exe" C:\Users\test22\AppData\Local\Temp\9dwcb1g2Vqh3Owz.dll,iItzzFKWzIZojfOFqJG
6780
rundll32.exe "C:\Windows\System32\rundll32.exe" C:\Users\test22\AppData\Local\Temp\9dwcb1g2Vqh3Owz.dll,ibqesePIQXoUwnfgkLvfcuMFHK
7140
rundll32.exe "C:\Windows\System32\rundll32.exe" C:\Users\test22\AppData\Local\Temp\9dwcb1g2Vqh3Owz.dll,ieuLWaTjVeuBYegSaGXuly
6372
rundll32.exe "C:\Windows\System32\rundll32.exe" C:\Users\test22\AppData\Local\Temp\9dwcb1g2Vqh3Owz.dll,igFffrhNCQcHQStroQFS
6708
rundll32.exe "C:\Windows\System32\rundll32.exe" C:\Users\test22\AppData\Local\Temp\9dwcb1g2Vqh3Owz.dll,irtTnxRuuXAWDuDRGCivHz
6172
rundll32.exe "C:\Windows\System32\rundll32.exe" C:\Users\test22\AppData\Local\Temp\9dwcb1g2Vqh3Owz.dll,jVNpFjHcSQ
6472
rundll32.exe "C:\Windows\System32\rundll32.exe" C:\Users\test22\AppData\Local\Temp\9dwcb1g2Vqh3Owz.dll,jotleypmamgIHEUfZPLSmMtq
6924
rundll32.exe "C:\Windows\System32\rundll32.exe" C:\Users\test22\AppData\Local\Temp\9dwcb1g2Vqh3Owz.dll,jrkFXlWfdhOn
6252
rundll32.exe "C:\Windows\System32\rundll32.exe" C:\Users\test22\AppData\Local\Temp\9dwcb1g2Vqh3Owz.dll,kOcvjMhVkKI
6152
rundll32.exe "C:\Windows\System32\rundll32.exe" C:\Users\test22\AppData\Local\Temp\9dwcb1g2Vqh3Owz.dll,kPsHiOxOlxeVBpHYooACxIXHB
6988
rundll32.exe "C:\Windows\System32\rundll32.exe" C:\Users\test22\AppData\Local\Temp\9dwcb1g2Vqh3Owz.dll,kUHyuFSDHjRQgcFnZIHgvahta
7096
rundll32.exe "C:\Windows\System32\rundll32.exe" C:\Users\test22\AppData\Local\Temp\9dwcb1g2Vqh3Owz.dll,kXMermOELWqc
6748
rundll32.exe "C:\Windows\System32\rundll32.exe" C:\Users\test22\AppData\Local\Temp\9dwcb1g2Vqh3Owz.dll,kkWRnVCjitIbHTy
7248
rundll32.exe "C:\Windows\System32\rundll32.exe" C:\Users\test22\AppData\Local\Temp\9dwcb1g2Vqh3Owz.dll,kpoFTDgQJFpD
7372
rundll32.exe "C:\Windows\System32\rundll32.exe" C:\Users\test22\AppData\Local\Temp\9dwcb1g2Vqh3Owz.dll,kvCgXPvHuWWWdAHGy
7468
rundll32.exe "C:\Windows\System32\rundll32.exe" C:\Users\test22\AppData\Local\Temp\9dwcb1g2Vqh3Owz.dll,lFcjChjFWgKWuOuaAxn
7588
rundll32.exe "C:\Windows\System32\rundll32.exe" C:\Users\test22\AppData\Local\Temp\9dwcb1g2Vqh3Owz.dll,lKFTvqNg
7704
rundll32.exe "C:\Windows\System32\rundll32.exe" C:\Users\test22\AppData\Local\Temp\9dwcb1g2Vqh3Owz.dll,lcbnVGCdYXcKZTYevsVX
7832
rundll32.exe "C:\Windows\System32\rundll32.exe" C:\Users\test22\AppData\Local\Temp\9dwcb1g2Vqh3Owz.dll,lefIOOsVMhliLLj
7940
rundll32.exe "C:\Windows\System32\rundll32.exe" C:\Users\test22\AppData\Local\Temp\9dwcb1g2Vqh3Owz.dll,mKrNVAlauoRSIht
8064
rundll32.exe "C:\Windows\System32\rundll32.exe" C:\Users\test22\AppData\Local\Temp\9dwcb1g2Vqh3Owz.dll,nRVfeUAoalGiEviupjuyTviKt
8180
rundll32.exe "C:\Windows\System32\rundll32.exe" C:\Users\test22\AppData\Local\Temp\9dwcb1g2Vqh3Owz.dll,nWkMZMN
7364
rundll32.exe "C:\Windows\System32\rundll32.exe" C:\Users\test22\AppData\Local\Temp\9dwcb1g2Vqh3Owz.dll,naKLRCkO
7452
rundll32.exe "C:\Windows\System32\rundll32.exe" C:\Users\test22\AppData\Local\Temp\9dwcb1g2Vqh3Owz.dll,njUWLbQgRBGSd
7664
rundll32.exe "C:\Windows\System32\rundll32.exe" C:\Users\test22\AppData\Local\Temp\9dwcb1g2Vqh3Owz.dll,nlBfCJTJQhnnPxbkQkUAwWpmaA
7800
rundll32.exe "C:\Windows\System32\rundll32.exe" C:\Users\test22\AppData\Local\Temp\9dwcb1g2Vqh3Owz.dll,nmBYnmjGCq
8020
rundll32.exe "C:\Windows\System32\rundll32.exe" C:\Users\test22\AppData\Local\Temp\9dwcb1g2Vqh3Owz.dll,oIAdOUfQaetEfqMDSL
7240
rundll32.exe "C:\Windows\System32\rundll32.exe" C:\Users\test22\AppData\Local\Temp\9dwcb1g2Vqh3Owz.dll,osSAAvHx
7424
rundll32.exe "C:\Windows\System32\rundll32.exe" C:\Users\test22\AppData\Local\Temp\9dwcb1g2Vqh3Owz.dll,ovwgmHjsMpOQyjNpuqeLd
7652
rundll32.exe "C:\Windows\System32\rundll32.exe" C:\Users\test22\AppData\Local\Temp\9dwcb1g2Vqh3Owz.dll,ozpFyAlRWIHNYPuJbOLpoZosmO
7756
rundll32.exe "C:\Windows\System32\rundll32.exe" C:\Users\test22\AppData\Local\Temp\9dwcb1g2Vqh3Owz.dll,pAbWNQjHuawouRBUprBVrXw
8100
rundll32.exe "C:\Windows\System32\rundll32.exe" C:\Users\test22\AppData\Local\Temp\9dwcb1g2Vqh3Owz.dll,pCYRinZyYkFOxayPFyJDEDxKzO
7196
rundll32.exe "C:\Windows\System32\rundll32.exe" C:\Users\test22\AppData\Local\Temp\9dwcb1g2Vqh3Owz.dll,pQvYHQSqPMdqFOFub
7640
rundll32.exe "C:\Windows\System32\rundll32.exe" C:\Users\test22\AppData\Local\Temp\9dwcb1g2Vqh3Owz.dll,pbzbgZeZipMwitVYJJbYTdyYQ
7784
rundll32.exe "C:\Windows\System32\rundll32.exe" C:\Users\test22\AppData\Local\Temp\9dwcb1g2Vqh3Owz.dll,pnbxRJnSdfpDADRIEWZXepR
8104
rundll32.exe "C:\Windows\System32\rundll32.exe" C:\Users\test22\AppData\Local\Temp\9dwcb1g2Vqh3Owz.dll,qAirVWefWGdomxGs
7824
rundll32.exe "C:\Windows\System32\rundll32.exe" C:\Users\test22\AppData\Local\Temp\9dwcb1g2Vqh3Owz.dll,qbgUwwXPUNM
7464
rundll32.exe "C:\Windows\System32\rundll32.exe" C:\Users\test22\AppData\Local\Temp\9dwcb1g2Vqh3Owz.dll,rJVMJaiBojiOWxURyzmLWnxH
8136
rundll32.exe "C:\Windows\System32\rundll32.exe" C:\Users\test22\AppData\Local\Temp\9dwcb1g2Vqh3Owz.dll,rOlGGoosrOYjYnwqSX
8028
rundll32.exe "C:\Windows\System32\rundll32.exe" C:\Users\test22\AppData\Local\Temp\9dwcb1g2Vqh3Owz.dll,rSHUNkevMkknNwSlqR
7580
rundll32.exe "C:\Windows\System32\rundll32.exe" C:\Users\test22\AppData\Local\Temp\9dwcb1g2Vqh3Owz.dll,rmrMOmqIIM
8296
rundll32.exe "C:\Windows\System32\rundll32.exe" C:\Users\test22\AppData\Local\Temp\9dwcb1g2Vqh3Owz.dll,sBcaPzIWckINwkFTBxmdkiKID
8420
rundll32.exe "C:\Windows\System32\rundll32.exe" C:\Users\test22\AppData\Local\Temp\9dwcb1g2Vqh3Owz.dll,sJXDLm
8540
rundll32.exe "C:\Windows\System32\rundll32.exe" C:\Users\test22\AppData\Local\Temp\9dwcb1g2Vqh3Owz.dll,sNQjkxnpfL
8672
rundll32.exe "C:\Windows\System32\rundll32.exe" C:\Users\test22\AppData\Local\Temp\9dwcb1g2Vqh3Owz.dll,sPKnvGEKVGRHsXgbRRJFS
8776
rundll32.exe "C:\Windows\System32\rundll32.exe" C:\Users\test22\AppData\Local\Temp\9dwcb1g2Vqh3Owz.dll,snoSMpnSAlGCDUoadZDE
8888
rundll32.exe "C:\Windows\System32\rundll32.exe" C:\Users\test22\AppData\Local\Temp\9dwcb1g2Vqh3Owz.dll,tGDiqYCDbgMaBXHmxqrJv
9016
rundll32.exe "C:\Windows\System32\rundll32.exe" C:\Users\test22\AppData\Local\Temp\9dwcb1g2Vqh3Owz.dll,tGdwKquShaUWskzgERPqeG
9140
rundll32.exe "C:\Windows\System32\rundll32.exe" C:\Users\test22\AppData\Local\Temp\9dwcb1g2Vqh3Owz.dll,tXncljehbaR
8060
rundll32.exe "C:\Windows\System32\rundll32.exe" C:\Users\test22\AppData\Local\Temp\9dwcb1g2Vqh3Owz.dll,taNCAYWnFedga
8416
rundll32.exe "C:\Windows\System32\rundll32.exe" C:\Users\test22\AppData\Local\Temp\9dwcb1g2Vqh3Owz.dll,uFBMgXMRHfYmHKtd
8576
rundll32.exe "C:\Windows\System32\rundll32.exe" C:\Users\test22\AppData\Local\Temp\9dwcb1g2Vqh3Owz.dll,uQadijPTgYiRGTkxDpqTOeI
608
rundll32.exe "C:\Windows\System32\rundll32.exe" C:\Users\test22\AppData\Local\Temp\9dwcb1g2Vqh3Owz.dll,vlEZdJoJilVuJxGaLFCzX
8868
rundll32.exe "C:\Windows\System32\rundll32.exe" C:\Users\test22\AppData\Local\Temp\9dwcb1g2Vqh3Owz.dll,vlPATCQWfWfv
9028
rundll32.exe "C:\Windows\System32\rundll32.exe" C:\Users\test22\AppData\Local\Temp\9dwcb1g2Vqh3Owz.dll,vnMwerzIvV
9200
rundll32.exe "C:\Windows\System32\rundll32.exe" C:\Users\test22\AppData\Local\Temp\9dwcb1g2Vqh3Owz.dll,wDtWqzCTVUWdqo
8368
rundll32.exe "C:\Windows\System32\rundll32.exe" C:\Users\test22\AppData\Local\Temp\9dwcb1g2Vqh3Owz.dll,weKcSTEtgvLwNKGEWr
8636
rundll32.exe "C:\Windows\System32\rundll32.exe" C:\Users\test22\AppData\Local\Temp\9dwcb1g2Vqh3Owz.dll,wyslQDXAh
8836
rundll32.exe "C:\Windows\System32\rundll32.exe" C:\Users\test22\AppData\Local\Temp\9dwcb1g2Vqh3Owz.dll,xRklmHvgNdkXc
9048
rundll32.exe "C:\Windows\System32\rundll32.exe" C:\Users\test22\AppData\Local\Temp\9dwcb1g2Vqh3Owz.dll,xbTTVacjLMTUBskAADEzpolBV
8220
rundll32.exe "C:\Windows\System32\rundll32.exe" C:\Users\test22\AppData\Local\Temp\9dwcb1g2Vqh3Owz.dll,xbcfQIhiMJswKveISUtGpEWTr
1912
rundll32.exe "C:\Windows\System32\rundll32.exe" C:\Users\test22\AppData\Local\Temp\9dwcb1g2Vqh3Owz.dll,ytgHNsgBKfkMoZjHI
8812
rundll32.exe "C:\Windows\System32\rundll32.exe" C:\Users\test22\AppData\Local\Temp\9dwcb1g2Vqh3Owz.dll,zLypEkbxfdampkTf
7700
rundll32.exe "C:\Windows\System32\rundll32.exe" C:\Users\test22\AppData\Local\Temp\9dwcb1g2Vqh3Owz.dll,ziTLFIzOnbzURBefGdA
8736
rundll32.exe "C:\Windows\System32\rundll32.exe" C:\Users\test22\AppData\Local\Temp\9dwcb1g2Vqh3Owz.dll,
9212

Name	Response	Post-Analysis Lookup
No hosts contacted.

IP Address	Status	Action
103.126.216.86	Active	Moloch
103.224.241.74	Active	Moloch
103.41.204.169	Active	Moloch
103.71.99.57	Active	Moloch
103.85.95.4	Active	Moloch
104.248.225.227	Active	Moloch
128.199.217.206	Active	Moloch
139.196.72.155	Active	Moloch
139.59.80.108	Active	Moloch
165.232.185.110	Active	Moloch
174.138.33.49	Active	Moloch
175.126.176.79	Active	Moloch
178.238.225.252	Active	Moloch
178.62.112.199	Active	Moloch
188.165.79.151	Active	Moloch
188.225.32.231	Active	Moloch
190.145.8.4	Active	Moloch
196.44.98.190	Active	Moloch
198.199.70.22	Active	Moloch
202.134.4.210	Active	Moloch
37.44.244.177	Active	Moloch
5.253.30.17	Active	Moloch
54.37.106.167	Active	Moloch
54.37.228.122	Active	Moloch
62.171.178.147	Active	Moloch
87.106.97.83	Active	Moloch

Suricata Alerts

Flow	SID	Signature	Category
TCP 192.168.56.101:49385 -> 188.165.79.151:443	2404310	ET CNC Feodo Tracker Reported CnC Server group 11	A Network Trojan was detected
TCP 192.168.56.101:49389 -> 196.44.98.190:8080	2404312	ET CNC Feodo Tracker Reported CnC Server group 13	A Network Trojan was detected
TCP 192.168.56.101:49402 -> 104.248.225.227:8080	2404301	ET CNC Feodo Tracker Reported CnC Server group 2	A Network Trojan was detected
TCP 192.168.56.101:49402 -> 104.248.225.227:8080	2028401	ET JA3 Hash - Possible Malware - Various Trickbot/Kovter/Dridex	Unknown Traffic
TCP 192.168.56.101:49385 -> 188.165.79.151:443	2028401	ET JA3 Hash - Possible Malware - Various Trickbot/Kovter/Dridex	Unknown Traffic
TCP 192.168.56.101:49394 -> 5.253.30.17:7080	2404320	ET CNC Feodo Tracker Reported CnC Server group 21	A Network Trojan was detected
TCP 188.165.79.151:443 -> 192.168.56.101:49387	2029340	ET INFO TLS Handshake Failure	Potentially Bad Traffic
TCP 192.168.56.101:49403 -> 104.248.225.227:8080	2028401	ET JA3 Hash - Possible Malware - Various Trickbot/Kovter/Dridex	Unknown Traffic
TCP 192.168.56.101:49394 -> 5.253.30.17:7080	2028401	ET JA3 Hash - Possible Malware - Various Trickbot/Kovter/Dridex	Unknown Traffic
TCP 192.168.56.101:49390 -> 196.44.98.190:8080	2028401	ET JA3 Hash - Possible Malware - Various Trickbot/Kovter/Dridex	Unknown Traffic
TCP 192.168.56.101:49383 -> 174.138.33.49:7080	2404308	ET CNC Feodo Tracker Reported CnC Server group 9	A Network Trojan was detected
TCP 192.168.56.101:49420 -> 103.224.241.74:8080	2404300	ET CNC Feodo Tracker Reported CnC Server group 1	A Network Trojan was detected
TCP 104.248.225.227:8080 -> 192.168.56.101:49404	2029340	ET INFO TLS Handshake Failure	Potentially Bad Traffic
TCP 198.199.70.22:8080 -> 192.168.56.101:49413	2029340	ET INFO TLS Handshake Failure	Potentially Bad Traffic
TCP 192.168.56.101:49389 -> 196.44.98.190:8080	2028401	ET JA3 Hash - Possible Malware - Various Trickbot/Kovter/Dridex	Unknown Traffic
TCP 103.224.241.74:8080 -> 192.168.56.101:49420	2029340	ET INFO TLS Handshake Failure	Potentially Bad Traffic
TCP 192.168.56.101:49386 -> 188.165.79.151:443	2028401	ET JA3 Hash - Possible Malware - Various Trickbot/Kovter/Dridex	Unknown Traffic
TCP 192.168.56.101:49412 -> 198.199.70.22:8080	2028401	ET JA3 Hash - Possible Malware - Various Trickbot/Kovter/Dridex	Unknown Traffic
TCP 192.168.56.101:49393 -> 5.253.30.17:7080	2028401	ET JA3 Hash - Possible Malware - Various Trickbot/Kovter/Dridex	Unknown Traffic
TCP 192.168.56.101:49432 -> 139.196.72.155:8080	2404303	ET CNC Feodo Tracker Reported CnC Server group 4	A Network Trojan was detected
TCP 192.168.56.101:49418 -> 103.224.241.74:8080	2028401	ET JA3 Hash - Possible Malware - Various Trickbot/Kovter/Dridex	Unknown Traffic
TCP 196.44.98.190:8080 -> 192.168.56.101:49391	2029340	ET INFO TLS Handshake Failure	Potentially Bad Traffic
TCP 192.168.56.101:49419 -> 103.224.241.74:8080	2028401	ET JA3 Hash - Possible Malware - Various Trickbot/Kovter/Dridex	Unknown Traffic
TCP 192.168.56.101:49432 -> 139.196.72.155:8080	2028401	ET JA3 Hash - Possible Malware - Various Trickbot/Kovter/Dridex	Unknown Traffic
TCP 192.168.56.101:49408 -> 54.37.106.167:8080	2028401	ET JA3 Hash - Possible Malware - Various Trickbot/Kovter/Dridex	Unknown Traffic
TCP 5.253.30.17:7080 -> 192.168.56.101:49395	2029340	ET INFO TLS Handshake Failure	Potentially Bad Traffic
TCP 192.168.56.101:49423 -> 178.62.112.199:8080	2028401	ET JA3 Hash - Possible Malware - Various Trickbot/Kovter/Dridex	Unknown Traffic
TCP 54.37.106.167:8080 -> 192.168.56.101:49409	2029340	ET INFO TLS Handshake Failure	Potentially Bad Traffic
TCP 192.168.56.101:49435 -> 188.225.32.231:4143	2028401	ET JA3 Hash - Possible Malware - Various Trickbot/Kovter/Dridex	Unknown Traffic
TCP 192.168.56.101:49407 -> 54.37.106.167:8080	2028401	ET JA3 Hash - Possible Malware - Various Trickbot/Kovter/Dridex	Unknown Traffic
TCP 192.168.56.101:49436 -> 188.225.32.231:4143	2028401	ET JA3 Hash - Possible Malware - Various Trickbot/Kovter/Dridex	Unknown Traffic
TCP 192.168.56.101:49411 -> 198.199.70.22:8080	2028401	ET JA3 Hash - Possible Malware - Various Trickbot/Kovter/Dridex	Unknown Traffic
TCP 192.168.56.101:49422 -> 178.62.112.199:8080	2028401	ET JA3 Hash - Possible Malware - Various Trickbot/Kovter/Dridex	Unknown Traffic
TCP 192.168.56.101:49431 -> 139.196.72.155:8080	2028401	ET JA3 Hash - Possible Malware - Various Trickbot/Kovter/Dridex	Unknown Traffic
TCP 188.225.32.231:4143 -> 192.168.56.101:49437	2029340	ET INFO TLS Handshake Failure	Potentially Bad Traffic
TCP 192.168.56.101:49440 -> 103.126.216.86:443	2028401	ET JA3 Hash - Possible Malware - Various Trickbot/Kovter/Dridex	Unknown Traffic
TCP 192.168.56.101:49441 -> 103.126.216.86:443	2028401	ET JA3 Hash - Possible Malware - Various Trickbot/Kovter/Dridex	Unknown Traffic
TCP 192.168.56.101:49424 -> 178.62.112.199:8080	2404309	ET CNC Feodo Tracker Reported CnC Server group 10	A Network Trojan was detected
TCP 178.62.112.199:8080 -> 192.168.56.101:49424	2029340	ET INFO TLS Handshake Failure	Potentially Bad Traffic
TCP 139.196.72.155:8080 -> 192.168.56.101:49433	2029340	ET INFO TLS Handshake Failure	Potentially Bad Traffic
TCP 103.126.216.86:443 -> 192.168.56.101:49442	2029340	ET INFO TLS Handshake Failure	Potentially Bad Traffic

Suricata TLS

No Suricata TLS

Queries for the computername (1 event)

Time & API	Arguments	Status	Return	Repeated
GetComputerNameA July 8, 2022, 8:14 p.m.	computer_name: TEST22-PC	1	1	0

Checks amount of memory in system, this can be used to detect virtual machines that have a low amount of memory available (1 event)

Time & API	Arguments	Status	Return	Repeated
GlobalMemoryStatusEx July 8, 2022, 8:21 p.m.		1	1	0

One or more processes crashed (2 events)

Time & API	Arguments	Status	Return	Repeated
__exception__ July 8, 2022, 8:21 p.m.	stacktrace: CtfImeIsIME+0x36fd DllUnregisterServer-0xf9d9 msctf+0x2d08c @ 0x7659d08c TF_GetGlobalCompartment+0x3dfd CtfImeIsIME-0x344 msctf+0x2964b @ 0x7659964b TF_GetInputScope+0xf65 CtfImeDestroyThreadMgr-0x25ae msctf+0x14d6b @ 0x76584d6b TF_GetInputScope+0x3176 CtfImeDestroyThreadMgr-0x39d msctf+0x16f7c @ 0x76586f7c CtfImeDestroyInputContext+0x280 TF_CanUninitialize-0x1c msctf+0x1e825 @ 0x7658e825 TF_GetInputScope+0x21fc CtfImeDestroyThreadMgr-0x1317 msctf+0x16002 @ 0x76586002 TF_GetInputScope+0x21e2 CtfImeDestroyThreadMgr-0x1331 msctf+0x15fe8 @ 0x76585fe8 TF_GetInputScope+0xbdd CtfImeDestroyThreadMgr-0x2936 msctf+0x149e3 @ 0x765849e3 TF_GetInputScope+0x1c1a CtfImeDestroyThreadMgr-0x18f9 msctf+0x15a20 @ 0x76585a20 RtlIsCurrentThreadAttachExempt+0x5f TpCheckTerminateWorker-0x37 ntdll+0x39a91 @ 0x77679a91 LdrShutdownProcess+0x97 RtlDetectHeapLeaks-0x1bb ntdll+0x58f10 @ 0x77698f10 RtlExitUserProcess+0x74 LdrShutdownProcess-0x1d ntdll+0x58e5c @ 0x77698e5c ExitProcess+0x15 TerminateThread-0xa kernel32+0x17a25 @ 0x766e7a25 rundll32+0x135c @ 0xce135c rundll32+0x1901 @ 0xce1901 BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x766e33ca RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x77679ed2 RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x77679ea5 exception.instruction_r: ff 51 0c 8b 45 fc 89 be 8c 04 00 00 3b c7 74 25 exception.symbol: TF_GetCompatibleKeyboardLayout+0x5885 TF_IsCtfmonRunning-0xfd3 msctf+0x43ef4 exception.instruction: call dword ptr [ecx + 0xc] exception.module: MSCTF.dll exception.exception_code: 0xc0000005 exception.offset: 278260 exception.address: 0x765b3ef4 registers.esp: 915476 registers.edi: 0 registers.eax: 13341464 registers.ebp: 915504 registers.edx: 1 registers.ebx: 0 registers.esi: 5162792 registers.ecx: 1940010460	1	0	0
__exception__ July 8, 2022, 8:22 p.m.	stacktrace: CtfImeIsIME+0x36fd DllUnregisterServer-0xf9d9 msctf+0x2d08c @ 0x7659d08c TF_GetGlobalCompartment+0x3dfd CtfImeIsIME-0x344 msctf+0x2964b @ 0x7659964b TF_GetInputScope+0xf65 CtfImeDestroyThreadMgr-0x25ae msctf+0x14d6b @ 0x76584d6b TF_GetInputScope+0x3176 CtfImeDestroyThreadMgr-0x39d msctf+0x16f7c @ 0x76586f7c CtfImeDestroyInputContext+0x280 TF_CanUninitialize-0x1c msctf+0x1e825 @ 0x7658e825 TF_GetInputScope+0x21fc CtfImeDestroyThreadMgr-0x1317 msctf+0x16002 @ 0x76586002 TF_GetInputScope+0x21e2 CtfImeDestroyThreadMgr-0x1331 msctf+0x15fe8 @ 0x76585fe8 TF_GetInputScope+0xbdd CtfImeDestroyThreadMgr-0x2936 msctf+0x149e3 @ 0x765849e3 TF_GetInputScope+0x1c1a CtfImeDestroyThreadMgr-0x18f9 msctf+0x15a20 @ 0x76585a20 RtlIsCurrentThreadAttachExempt+0x5f TpCheckTerminateWorker-0x37 ntdll+0x39a91 @ 0x77679a91 LdrShutdownProcess+0x97 RtlDetectHeapLeaks-0x1bb ntdll+0x58f10 @ 0x77698f10 RtlExitUserProcess+0x74 LdrShutdownProcess-0x1d ntdll+0x58e5c @ 0x77698e5c ExitProcess+0x15 TerminateThread-0xa kernel32+0x17a25 @ 0x766e7a25 rundll32+0x135c @ 0xce135c rundll32+0x1901 @ 0xce1901 BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x766e33ca RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x77679ed2 RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x77679ea5 exception.instruction_r: ff 51 0c 8b 45 fc 89 be 8c 04 00 00 3b c7 74 25 exception.symbol: TF_GetCompatibleKeyboardLayout+0x5885 TF_IsCtfmonRunning-0xfd3 msctf+0x43ef4 exception.instruction: call dword ptr [ecx + 0xc] exception.module: MSCTF.dll exception.exception_code: 0xc0000005 exception.offset: 278260 exception.address: 0x765b3ef4 registers.esp: 1242436 registers.edi: 0 registers.eax: 12948248 registers.ebp: 1242464 registers.edx: 1 registers.ebx: 0 registers.esi: 5163784 registers.ecx: 1940010460	1	0	0

Time & API

Arguments

Status

Return

Repeated

__exception__

July 8, 2022, 8:21 p.m.

stacktrace:

CtfImeIsIME+0x36fd DllUnregisterServer-0xf9d9 msctf+0x2d08c @ 0x7659d08c
TF_GetGlobalCompartment+0x3dfd CtfImeIsIME-0x344 msctf+0x2964b @ 0x7659964b
TF_GetInputScope+0xf65 CtfImeDestroyThreadMgr-0x25ae msctf+0x14d6b @ 0x76584d6b
TF_GetInputScope+0x3176 CtfImeDestroyThreadMgr-0x39d msctf+0x16f7c @ 0x76586f7c
CtfImeDestroyInputContext+0x280 TF_CanUninitialize-0x1c msctf+0x1e825 @ 0x7658e825
TF_GetInputScope+0x21fc CtfImeDestroyThreadMgr-0x1317 msctf+0x16002 @ 0x76586002
TF_GetInputScope+0x21e2 CtfImeDestroyThreadMgr-0x1331 msctf+0x15fe8 @ 0x76585fe8
TF_GetInputScope+0xbdd CtfImeDestroyThreadMgr-0x2936 msctf+0x149e3 @ 0x765849e3
TF_GetInputScope+0x1c1a CtfImeDestroyThreadMgr-0x18f9 msctf+0x15a20 @ 0x76585a20
RtlIsCurrentThreadAttachExempt+0x5f TpCheckTerminateWorker-0x37 ntdll+0x39a91 @ 0x77679a91
LdrShutdownProcess+0x97 RtlDetectHeapLeaks-0x1bb ntdll+0x58f10 @ 0x77698f10
RtlExitUserProcess+0x74 LdrShutdownProcess-0x1d ntdll+0x58e5c @ 0x77698e5c
ExitProcess+0x15 TerminateThread-0xa kernel32+0x17a25 @ 0x766e7a25
rundll32+0x135c @ 0xce135c
rundll32+0x1901 @ 0xce1901
BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x766e33ca
RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x77679ed2
RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x77679ea5

exception.instruction_r: ff 51 0c 8b 45 fc 89 be 8c 04 00 00 3b c7 74 25
exception.symbol: TF_GetCompatibleKeyboardLayout+0x5885 TF_IsCtfmonRunning-0xfd3 msctf+0x43ef4
exception.instruction: call dword ptr [ecx + 0xc]
exception.module: MSCTF.dll
exception.exception_code: 0xc0000005
exception.offset: 278260
exception.address: 0x765b3ef4
registers.esp: 915476
registers.edi: 0
registers.eax: 13341464
registers.ebp: 915504
registers.edx: 1
registers.ebx: 0
registers.esi: 5162792
registers.ecx: 1940010460

__exception__

July 8, 2022, 8:22 p.m.

stacktrace:

CtfImeIsIME+0x36fd DllUnregisterServer-0xf9d9 msctf+0x2d08c @ 0x7659d08c
TF_GetGlobalCompartment+0x3dfd CtfImeIsIME-0x344 msctf+0x2964b @ 0x7659964b
TF_GetInputScope+0xf65 CtfImeDestroyThreadMgr-0x25ae msctf+0x14d6b @ 0x76584d6b
TF_GetInputScope+0x3176 CtfImeDestroyThreadMgr-0x39d msctf+0x16f7c @ 0x76586f7c
CtfImeDestroyInputContext+0x280 TF_CanUninitialize-0x1c msctf+0x1e825 @ 0x7658e825
TF_GetInputScope+0x21fc CtfImeDestroyThreadMgr-0x1317 msctf+0x16002 @ 0x76586002
TF_GetInputScope+0x21e2 CtfImeDestroyThreadMgr-0x1331 msctf+0x15fe8 @ 0x76585fe8
TF_GetInputScope+0xbdd CtfImeDestroyThreadMgr-0x2936 msctf+0x149e3 @ 0x765849e3
TF_GetInputScope+0x1c1a CtfImeDestroyThreadMgr-0x18f9 msctf+0x15a20 @ 0x76585a20
RtlIsCurrentThreadAttachExempt+0x5f TpCheckTerminateWorker-0x37 ntdll+0x39a91 @ 0x77679a91
LdrShutdownProcess+0x97 RtlDetectHeapLeaks-0x1bb ntdll+0x58f10 @ 0x77698f10
RtlExitUserProcess+0x74 LdrShutdownProcess-0x1d ntdll+0x58e5c @ 0x77698e5c
ExitProcess+0x15 TerminateThread-0xa kernel32+0x17a25 @ 0x766e7a25
rundll32+0x135c @ 0xce135c
rundll32+0x1901 @ 0xce1901
BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x766e33ca
RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x77679ed2
RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x77679ea5

exception.instruction_r: ff 51 0c 8b 45 fc 89 be 8c 04 00 00 3b c7 74 25
exception.symbol: TF_GetCompatibleKeyboardLayout+0x5885 TF_IsCtfmonRunning-0xfd3 msctf+0x43ef4
exception.instruction: call dword ptr [ecx + 0xc]
exception.module: MSCTF.dll
exception.exception_code: 0xc0000005
exception.offset: 278260
exception.address: 0x765b3ef4
registers.esp: 1242436
registers.edi: 0
registers.eax: 12948248
registers.ebp: 1242464
registers.edx: 1
registers.ebx: 0
registers.esi: 5163784
registers.ecx: 1940010460

Communication to multiple IPs on high port numbers possibly indicative of a peer-to-peer (P2P) or non-standard command and control protocol (9 events)

ip	103.224.241.74
ip	104.248.225.227
ip	139.196.72.155
ip	178.62.112.199
ip	188.225.32.231
ip	196.44.98.190
ip	198.199.70.22
ip	5.253.30.17
ip	54.37.106.167

Allocates read-write-execute memory (usually to unpack itself) (50 out of 73 events)

Time & API	Arguments	Status
NtAllocateVirtualMemory July 8, 2022, 8:14 p.m.	process_identifier: 2284 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0000000001c40000 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory July 8, 2022, 8:14 p.m.	process_identifier: 2284 region_size: 188416 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0000000001c50000 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory July 8, 2022, 8:14 p.m.	process_identifier: 2284 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000000007391c000 process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory July 8, 2022, 8:14 p.m.	process_identifier: 2264 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0000000001dc0000 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory July 8, 2022, 8:14 p.m.	process_identifier: 2264 region_size: 188416 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0000000001dd0000 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory July 8, 2022, 8:14 p.m.	process_identifier: 2264 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000000007391c000 process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory July 8, 2022, 8:14 p.m.	process_identifier: 2480 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0000000001c40000 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory July 8, 2022, 8:14 p.m.	process_identifier: 2480 region_size: 188416 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0000000001dd0000 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory July 8, 2022, 8:14 p.m.	process_identifier: 2480 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000000007391c000 process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory July 8, 2022, 8:14 p.m.	process_identifier: 2784 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0000000001dc0000 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory July 8, 2022, 8:14 p.m.	process_identifier: 2784 region_size: 188416 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0000000001dd0000 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory July 8, 2022, 8:14 p.m.	process_identifier: 2784 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000000007391c000 process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory July 8, 2022, 8:14 p.m.	process_identifier: 2900 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0000000001c40000 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory July 8, 2022, 8:14 p.m.	process_identifier: 2900 region_size: 188416 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0000000001c60000 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory July 8, 2022, 8:14 p.m.	process_identifier: 2900 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000000007391c000 process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory July 8, 2022, 8:14 p.m.	process_identifier: 3068 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0000000001c40000 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory July 8, 2022, 8:14 p.m.	process_identifier: 3068 region_size: 188416 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0000000001c50000 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory July 8, 2022, 8:14 p.m.	process_identifier: 3068 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000000007391c000 process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory July 8, 2022, 8:14 p.m.	process_identifier: 2936 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0000000000510000 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory July 8, 2022, 8:14 p.m.	process_identifier: 2936 region_size: 188416 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0000000000520000 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory July 8, 2022, 8:14 p.m.	process_identifier: 2936 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000000007391c000 process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory July 8, 2022, 8:14 p.m.	process_identifier: 2388 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0000000000410000 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory July 8, 2022, 8:14 p.m.	process_identifier: 2388 region_size: 188416 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0000000001c70000 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory July 8, 2022, 8:14 p.m.	process_identifier: 2388 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000000007391c000 process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory July 8, 2022, 8:14 p.m.	process_identifier: 2448 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0000000000590000 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory July 8, 2022, 8:14 p.m.	process_identifier: 2448 region_size: 188416 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00000000005a0000 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory July 8, 2022, 8:14 p.m.	process_identifier: 2448 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000000007391c000 process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory July 8, 2022, 8:14 p.m.	process_identifier: 2556 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0000000001c40000 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory July 8, 2022, 8:14 p.m.	process_identifier: 2556 region_size: 188416 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0000000001c50000 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory July 8, 2022, 8:14 p.m.	process_identifier: 2556 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000000007391c000 process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory July 8, 2022, 8:14 p.m.	process_identifier: 900 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0000000001eb0000 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory July 8, 2022, 8:14 p.m.	process_identifier: 900 region_size: 188416 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0000000001ec0000 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory July 8, 2022, 8:14 p.m.	process_identifier: 900 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000000007391c000 process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory July 8, 2022, 8:14 p.m.	process_identifier: 316 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0000000001c40000 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory July 8, 2022, 8:14 p.m.	process_identifier: 316 region_size: 188416 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0000000001f70000 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory July 8, 2022, 8:14 p.m.	process_identifier: 316 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000000007391c000 process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory July 8, 2022, 8:14 p.m.	process_identifier: 2796 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0000000001c40000 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory July 8, 2022, 8:14 p.m.	process_identifier: 2796 region_size: 188416 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0000000001c80000 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory July 8, 2022, 8:14 p.m.	process_identifier: 2796 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000000007391c000 process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory July 8, 2022, 8:14 p.m.	process_identifier: 2952 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0000000001eb0000 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory July 8, 2022, 8:14 p.m.	process_identifier: 2952 region_size: 188416 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0000000001ec0000 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory July 8, 2022, 8:14 p.m.	process_identifier: 2952 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000000007391c000 process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory July 8, 2022, 8:14 p.m.	process_identifier: 2832 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0000000001e40000 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory July 8, 2022, 8:14 p.m.	process_identifier: 2832 region_size: 188416 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0000000001f60000 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory July 8, 2022, 8:14 p.m.	process_identifier: 2832 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000000007391c000 process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory July 8, 2022, 8:14 p.m.	process_identifier: 2304 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0000000001dd0000 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory July 8, 2022, 8:14 p.m.	process_identifier: 2304 region_size: 188416 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0000000001de0000 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory July 8, 2022, 8:14 p.m.	process_identifier: 2304 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000000007391c000 process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory July 8, 2022, 8:14 p.m.	process_identifier: 2344 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0000000001cc0000 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory July 8, 2022, 8:14 p.m.	process_identifier: 2344 region_size: 188416 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0000000001cd0000 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0xffffffffffffffff	1

Creates a suspicious process (1 event)

cmdline

C:\Windows\system32\regsvr32.exe "C:\Windows\system32\CzdBONwxxN\RuVOfPmjFdIf.dll"

Searches running processes potentially to identify processes for sandbox evasion, code injection or memory dumping (14 events)

Time & API	Arguments	Status	Return
Process32NextW July 8, 2022, 8:14 p.m.	snapshot_handle: 0x0000000000000144 process_name: pw.exe process_identifier: 2512	1	1
Process32NextW July 8, 2022, 8:14 p.m.	snapshot_handle: 0x0000000000000144 process_name: taskhost.exe process_identifier: 2548	1	1
Process32NextW July 8, 2022, 8:14 p.m.	snapshot_handle: 0x0000000000000144 process_name: sdclt.exe process_identifier: 2572	1	1
Process32NextW July 8, 2022, 8:14 p.m.	snapshot_handle: 0x0000000000000144 process_name: SearchProtocolHost.exe process_identifier: 2680	1	1
Process32NextW July 8, 2022, 8:14 p.m.	snapshot_handle: 0x0000000000000144 process_name: rundll32.exe process_identifier: 2780	1	1
Process32NextW July 8, 2022, 8:14 p.m.	snapshot_handle: 0x0000000000000144 process_name: rundll32.exe process_identifier: 2560	1	1
Process32NextW July 8, 2022, 8:14 p.m.	snapshot_handle: 0x0000000000000144 process_name: rundll32.exe process_identifier: 2740	1	1
Process32NextW July 8, 2022, 8:14 p.m.	snapshot_handle: 0x0000000000000144 process_name: rundll32.exe process_identifier: 2796	1	1
Process32NextW July 8, 2022, 8:14 p.m.	snapshot_handle: 0x0000000000000154 process_name: rundll32.exe process_identifier: 3564	1	1
Process32NextW July 8, 2022, 8:14 p.m.	snapshot_handle: 0x0000000000000154 process_name: rundll32.exe process_identifier: 3664	1	1
Process32NextW July 8, 2022, 8:14 p.m.	snapshot_handle: 0x0000000000000154 process_name: rundll32.exe process_identifier: 3672	1	1
Process32NextW July 8, 2022, 8:14 p.m.	snapshot_handle: 0x0000000000000154 process_name: rundll32.exe process_identifier: 3796	1	1
Process32NextW July 8, 2022, 8:14 p.m.	snapshot_handle: 0x0000000000000154 process_name: rundll32.exe process_identifier: 3896	1	1
Process32NextW July 8, 2022, 8:14 p.m.	snapshot_handle: 0x0000000000000154 process_name: regsvr32.exe process_identifier: 3904	1	1

File has been identified by 9 AntiVirus engines on VirusTotal as malicious (9 events)

FireEye	Generic.mg.88fcb7e4f43e8a1c
Kaspersky	VHO:Trojan-Banker.Win32.Emotet.gjir
TrendMicro	TrojanSpy.Win64.EMOTET.SMYXCFC
McAfee-GW-Edition	Emotet-FTY!88FCB7E4F43E
ZoneAlarm	VHO:Trojan-Banker.Win32.Emotet.gjir
McAfee	Emotet-FTY!88FCB7E4F43E
Rising	Trojan.Emotet!8.B95 (C64:YzY0OsbA4SlW4UTk)
AVG	BotX-gen [Trj]
Avast	BotX-gen [Trj]

The binary likely contains encrypted or compressed data indicative of a packer (2 events)

section

{u'size_of_data': u'0x0002e600', u'virtual_address': u'0x0001a000', u'entropy': 7.832588443776013, u'name': u'.rsrc', u'virtual_size': u'0x0002e480'}

entropy

7.83258844378

description

A section with a high entropy has been found

entropy

0.669675090253

description

Overall entropy of this PE file is high

Expresses interest in specific running processes (2 events)

process	regsvr32.exe
process	rundll32.exe

Communicates with host for which no DNS query was performed (26 events)

host	103.126.216.86
host	103.224.241.74
host	103.41.204.169
host	103.71.99.57
host	103.85.95.4
host	104.248.225.227
host	128.199.217.206
host	139.196.72.155
host	139.59.80.108
host	165.232.185.110
host	174.138.33.49
host	175.126.176.79
host	178.238.225.252
host	178.62.112.199
host	188.165.79.151
host	188.225.32.231
host	190.145.8.4
host	196.44.98.190
host	198.199.70.22
host	202.134.4.210
host	37.44.244.177
host	5.253.30.17
host	54.37.106.167
host	54.37.228.122
host	62.171.178.147
host	87.106.97.83

Installs itself for autorun at Windows startup (1 event)

service_name

RuVOfPmjFdIf.dll

service_path

C:\Windows\System32\regsvr32.exe "C:\Windows\system32\CzdBONwxxN\RuVOfPmjFdIf.dll"

Created a service where a service was also not started (1 event)

Time & API	Arguments	Status	Return	Repeated
CreateServiceW July 8, 2022, 8:14 p.m.	service_start_name: start_type: 2 password: display_name: RuVOfPmjFdIf.dll filepath: C:\Windows\System32\regsvr32.exe "C:\Windows\system32\CzdBONwxxN\RuVOfPmjFdIf.dll" service_name: RuVOfPmjFdIf.dll filepath_r: C:\Windows\system32\regsvr32.exe "C:\Windows\system32\CzdBONwxxN\RuVOfPmjFdIf.dll" desired_access: 2 service_handle: 0x00000000003e26f0 error_control: 0 service_type: 16 service_manager_handle: 0x00000000003b3e40	1	4073200	0

Attempts to remove evidence of file being downloaded from the Internet (1 event)

file	C:\Windows\System32\CzdBONwxxN\RuVOfPmjFdIf.dll:Zone.Identifier

Generates some ICMP traffic

Connects to IP addresses that are no longer responding to requests (legitimate services will remain up-and-running usually) (27 events)

dead_host	87.106.97.83:7080
dead_host	192.168.56.101:49417
dead_host	190.145.8.4:443
dead_host	103.85.95.4:8080
dead_host	192.168.56.101:49401
dead_host	192.168.56.101:49427
dead_host	165.232.185.110:8080
dead_host	192.168.56.101:49399
dead_host	103.71.99.57:8080
dead_host	103.41.204.169:8080
dead_host	192.168.56.101:49397
dead_host	192.168.56.101:49428
dead_host	192.168.56.101:49430
dead_host	128.199.217.206:443
dead_host	174.138.33.49:7080
dead_host	54.37.228.122:443
dead_host	192.168.56.101:49429
dead_host	192.168.56.101:49415
dead_host	175.126.176.79:8080
dead_host	62.171.178.147:8080
dead_host	192.168.56.101:49426
dead_host	178.238.225.252:8080
dead_host	139.59.80.108:8080
dead_host	37.44.244.177:8080
dead_host	192.168.56.101:49400
dead_host	202.134.4.210:7080
dead_host	192.168.56.101:49439

9dwcb1g2Vqh3Owz

Process Tree Toggle all

Network Toggle all

Suricata Toggle all

Suricata Alerts

Suricata TLS

Signatures Toggle All