Summary | ZeroBOX

Category	Machine	Started	Completed
FILE	s1_win7_x6401	July 15, 2022, 7:52 a.m.	July 15, 2022, 7:55 a.m.

Size	269.0KB
Type	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
MD5	`745dac0fc6ed20141b8e9b80b76addc4`
SHA256	`fbaf857bb62b3f5f78b894c92ef05ac19e155384ac881f59ee991f6983530229`
CRC32	`C49E1440`
ssdeep	`6144:HhuDhkX/MAXwTCFQi+2JW/PAiikmKx770v/5kjjB589:HhuDCvM0rQi1W/PAiikPNm+jD`
Yara	UPX_Zero - UPX packed file IsDLL - (no description) Malicious_Library_Zero - Malicious_Library IsPE64 - (no description) PE_Header_Zero - PE File Signature

rundll32.exe "C:\Windows\System32\rundll32.exe" C:\Users\test22\AppData\Local\Temp\FnrTI.dll,AjkRVrFNnyQmqXQdrComyaiwV
2776
- rundll32.exe "C:\Windows\System32\rundll32.exe" C:\Users\test22\AppData\Local\Temp\FnrTI.dll,AjkRVrFNnyQmqXQdrComyaiwV
  2304
rundll32.exe "C:\Windows\System32\rundll32.exe" C:\Users\test22\AppData\Local\Temp\FnrTI.dll,AkMhEGvNFpnSswjeCw
2888
- rundll32.exe "C:\Windows\System32\rundll32.exe" C:\Users\test22\AppData\Local\Temp\FnrTI.dll,AkMhEGvNFpnSswjeCw
  2420
rundll32.exe "C:\Windows\System32\rundll32.exe" C:\Users\test22\AppData\Local\Temp\FnrTI.dll,BMIWqtk
2984
- rundll32.exe "C:\Windows\System32\rundll32.exe" C:\Users\test22\AppData\Local\Temp\FnrTI.dll,BMIWqtk
  2516
rundll32.exe "C:\Windows\System32\rundll32.exe" C:\Users\test22\AppData\Local\Temp\FnrTI.dll,BpsBUyIiAmXYU
2064
- rundll32.exe "C:\Windows\System32\rundll32.exe" C:\Users\test22\AppData\Local\Temp\FnrTI.dll,BpsBUyIiAmXYU
  2720
rundll32.exe "C:\Windows\System32\rundll32.exe" C:\Users\test22\AppData\Local\Temp\FnrTI.dll,BxBybURSqJfOwVmXj
2132
- rundll32.exe "C:\Windows\System32\rundll32.exe" C:\Users\test22\AppData\Local\Temp\FnrTI.dll,BxBybURSqJfOwVmXj
  2924
rundll32.exe "C:\Windows\System32\rundll32.exe" C:\Users\test22\AppData\Local\Temp\FnrTI.dll,CCSLGUsdVtcCbfF
2252
- rundll32.exe "C:\Windows\System32\rundll32.exe" C:\Users\test22\AppData\Local\Temp\FnrTI.dll,CCSLGUsdVtcCbfF
  3004
rundll32.exe "C:\Windows\System32\rundll32.exe" C:\Users\test22\AppData\Local\Temp\FnrTI.dll,CWBdqFubMR
2448
- rundll32.exe "C:\Windows\System32\rundll32.exe" C:\Users\test22\AppData\Local\Temp\FnrTI.dll,CWBdqFubMR
  3056
rundll32.exe "C:\Windows\System32\rundll32.exe" C:\Users\test22\AppData\Local\Temp\FnrTI.dll,CbEceKaoQvfuhhIK
2792
- rundll32.exe "C:\Windows\System32\rundll32.exe" C:\Users\test22\AppData\Local\Temp\FnrTI.dll,CbEceKaoQvfuhhIK
  1304
rundll32.exe "C:\Windows\System32\rundll32.exe" C:\Users\test22\AppData\Local\Temp\FnrTI.dll,CcBDyidVYuvtjWfG
3068
- rundll32.exe "C:\Windows\System32\rundll32.exe" C:\Users\test22\AppData\Local\Temp\FnrTI.dll,CcBDyidVYuvtjWfG
  2768
rundll32.exe "C:\Windows\System32\rundll32.exe" C:\Users\test22\AppData\Local\Temp\FnrTI.dll,CeOVtVdkUnRPoUvswsvkEf
2416
- rundll32.exe "C:\Windows\System32\rundll32.exe" C:\Users\test22\AppData\Local\Temp\FnrTI.dll,CeOVtVdkUnRPoUvswsvkEf
  1988
rundll32.exe "C:\Windows\System32\rundll32.exe" C:\Users\test22\AppData\Local\Temp\FnrTI.dll,CvxIGiXAzAG
2860
- rundll32.exe "C:\Windows\System32\rundll32.exe" C:\Users\test22\AppData\Local\Temp\FnrTI.dll,CvxIGiXAzAG
  2436
rundll32.exe "C:\Windows\System32\rundll32.exe" C:\Users\test22\AppData\Local\Temp\FnrTI.dll,DPsWXvFrrwOLZwoq
2856
- rundll32.exe "C:\Windows\System32\rundll32.exe" C:\Users\test22\AppData\Local\Temp\FnrTI.dll,DPsWXvFrrwOLZwoq
  2744
rundll32.exe "C:\Windows\System32\rundll32.exe" C:\Users\test22\AppData\Local\Temp\FnrTI.dll,DllRegisterServer
2116
- rundll32.exe "C:\Windows\System32\rundll32.exe" C:\Users\test22\AppData\Local\Temp\FnrTI.dll,DllRegisterServer
  2812
  - regsvr32.exe C:\Windows\system32\regsvr32.exe "C:\Windows\system32\MxDzSVtwfSRlLv\dnfqUgyyGIrKnZE.dll"
    3724
rundll32.exe "C:\Windows\System32\rundll32.exe" C:\Users\test22\AppData\Local\Temp\FnrTI.dll,ENtihcf
2588
- rundll32.exe "C:\Windows\System32\rundll32.exe" C:\Users\test22\AppData\Local\Temp\FnrTI.dll,ENtihcf
  2572
rundll32.exe "C:\Windows\System32\rundll32.exe" C:\Users\test22\AppData\Local\Temp\FnrTI.dll,EVYoaysfyVmedMKzqOkd
2824
- rundll32.exe "C:\Windows\System32\rundll32.exe" C:\Users\test22\AppData\Local\Temp\FnrTI.dll,EVYoaysfyVmedMKzqOkd
  2884
rundll32.exe "C:\Windows\System32\rundll32.exe" C:\Users\test22\AppData\Local\Temp\FnrTI.dll,FSgLIbzCJsGhKrdTRUhBnjq
2756
- rundll32.exe "C:\Windows\System32\rundll32.exe" C:\Users\test22\AppData\Local\Temp\FnrTI.dll,FSgLIbzCJsGhKrdTRUhBnjq
  2292
rundll32.exe "C:\Windows\System32\rundll32.exe" C:\Users\test22\AppData\Local\Temp\FnrTI.dll,FXswjNvwqEmJHSzKXfB
152
- rundll32.exe "C:\Windows\System32\rundll32.exe" C:\Users\test22\AppData\Local\Temp\FnrTI.dll,FXswjNvwqEmJHSzKXfB
  2964
rundll32.exe "C:\Windows\System32\rundll32.exe" C:\Users\test22\AppData\Local\Temp\FnrTI.dll,FmRrLoGPniSXxeHYAaRXrsSIt
3108
- rundll32.exe "C:\Windows\System32\rundll32.exe" C:\Users\test22\AppData\Local\Temp\FnrTI.dll,FmRrLoGPniSXxeHYAaRXrsSIt
  3236
rundll32.exe "C:\Windows\System32\rundll32.exe" C:\Users\test22\AppData\Local\Temp\FnrTI.dll,FzYYWlRKDQMfKaJAUq
3228
- rundll32.exe "C:\Windows\System32\rundll32.exe" C:\Users\test22\AppData\Local\Temp\FnrTI.dll,FzYYWlRKDQMfKaJAUq
  3480
rundll32.exe "C:\Windows\System32\rundll32.exe" C:\Users\test22\AppData\Local\Temp\FnrTI.dll,GEQqgSeWrJkaNSdjOw
3368
- rundll32.exe "C:\Windows\System32\rundll32.exe" C:\Users\test22\AppData\Local\Temp\FnrTI.dll,GEQqgSeWrJkaNSdjOw
  3512
rundll32.exe "C:\Windows\System32\rundll32.exe" C:\Users\test22\AppData\Local\Temp\FnrTI.dll,GLvPFjzv
3472
- rundll32.exe "C:\Windows\System32\rundll32.exe" C:\Users\test22\AppData\Local\Temp\FnrTI.dll,GLvPFjzv
  3656
explorer.exe C:\Windows\Explorer.EXE
1156
rundll32.exe "C:\Windows\System32\rundll32.exe" C:\Users\test22\AppData\Local\Temp\FnrTI.dll,GTfYoyhXUmiOrfM
3648
- rundll32.exe "C:\Windows\System32\rundll32.exe" C:\Users\test22\AppData\Local\Temp\FnrTI.dll,GTfYoyhXUmiOrfM
  3812
rundll32.exe "C:\Windows\System32\rundll32.exe" C:\Users\test22\AppData\Local\Temp\FnrTI.dll,GlLOHKioWJZCQPS
3948
- rundll32.exe "C:\Windows\System32\rundll32.exe" C:\Users\test22\AppData\Local\Temp\FnrTI.dll,GlLOHKioWJZCQPS
  3152
rundll32.exe "C:\Windows\System32\rundll32.exe" C:\Users\test22\AppData\Local\Temp\FnrTI.dll,GVTerofsGHUASHLhWfIFX
3848
- rundll32.exe "C:\Windows\System32\rundll32.exe" C:\Users\test22\AppData\Local\Temp\FnrTI.dll,GVTerofsGHUASHLhWfIFX
  2400
rundll32.exe "C:\Windows\System32\rundll32.exe" C:\Users\test22\AppData\Local\Temp\FnrTI.dll,GpqOdmj
4036
- rundll32.exe "C:\Windows\System32\rundll32.exe" C:\Users\test22\AppData\Local\Temp\FnrTI.dll,GpqOdmj
  3260
rundll32.exe "C:\Windows\System32\rundll32.exe" C:\Users\test22\AppData\Local\Temp\FnrTI.dll,GtaEQGQNcgERZqWo
3104
- rundll32.exe "C:\Windows\System32\rundll32.exe" C:\Users\test22\AppData\Local\Temp\FnrTI.dll,GtaEQGQNcgERZqWo
  2396
rundll32.exe "C:\Windows\System32\rundll32.exe" C:\Users\test22\AppData\Local\Temp\FnrTI.dll,GzdHPyIXWoMGb
3248
rundll32.exe "C:\Windows\System32\rundll32.exe" C:\Users\test22\AppData\Local\Temp\FnrTI.dll,HKgdkPfboZzjQODFfSu
3640
rundll32.exe "C:\Windows\System32\rundll32.exe" C:\Users\test22\AppData\Local\Temp\FnrTI.dll,HmXZBMEhrWvTg
3824
rundll32.exe "C:\Windows\System32\rundll32.exe" C:\Users\test22\AppData\Local\Temp\FnrTI.dll,HvFWvy
4020
rundll32.exe "C:\Windows\System32\rundll32.exe" C:\Users\test22\AppData\Local\Temp\FnrTI.dll,ICrKqnEJHHrxYaH
3308
rundll32.exe "C:\Windows\System32\rundll32.exe" C:\Users\test22\AppData\Local\Temp\FnrTI.dll,IDENrF
3552
rundll32.exe "C:\Windows\System32\rundll32.exe" C:\Users\test22\AppData\Local\Temp\FnrTI.dll,ISuniIBoqjzfv
3484
rundll32.exe "C:\Windows\System32\rundll32.exe" C:\Users\test22\AppData\Local\Temp\FnrTI.dll,IcEiBSQQHwaxZGs
4028
rundll32.exe "C:\Windows\System32\rundll32.exe" C:\Users\test22\AppData\Local\Temp\FnrTI.dll,JCFScdjDVMLKVa
3324
rundll32.exe "C:\Windows\System32\rundll32.exe" C:\Users\test22\AppData\Local\Temp\FnrTI.dll,JGwGKVHFHwfxsyCIp
556
rundll32.exe "C:\Windows\System32\rundll32.exe" C:\Users\test22\AppData\Local\Temp\FnrTI.dll,JnkFkZthy
3680
rundll32.exe "C:\Windows\System32\rundll32.exe" C:\Users\test22\AppData\Local\Temp\FnrTI.dll,LSRvMYckceDUkCMxwUAq
232
rundll32.exe "C:\Windows\System32\rundll32.exe" C:\Users\test22\AppData\Local\Temp\FnrTI.dll,LhZoEaJRggyJr
1548
rundll32.exe "C:\Windows\System32\rundll32.exe" C:\Users\test22\AppData\Local\Temp\FnrTI.dll,MknuTlXosJJdvczIkg
1872
rundll32.exe "C:\Windows\System32\rundll32.exe" C:\Users\test22\AppData\Local\Temp\FnrTI.dll,MrhDZxAutnSSobTVt
3892
rundll32.exe "C:\Windows\System32\rundll32.exe" C:\Users\test22\AppData\Local\Temp\FnrTI.dll,NRfTvw
3156
rundll32.exe "C:\Windows\System32\rundll32.exe" C:\Users\test22\AppData\Local\Temp\FnrTI.dll,NZDMYgNWoHhCVPBFWyuTBSesQ
1820
rundll32.exe "C:\Windows\System32\rundll32.exe" C:\Users\test22\AppData\Local\Temp\FnrTI.dll,NmBmwe
3508
rundll32.exe "C:\Windows\System32\rundll32.exe" C:\Users\test22\AppData\Local\Temp\FnrTI.dll,NzYPpUvQ
2384
rundll32.exe "C:\Windows\System32\rundll32.exe" C:\Users\test22\AppData\Local\Temp\FnrTI.dll,OThzaIZTEfYKTCCRQlcnW
2920
rundll32.exe "C:\Windows\System32\rundll32.exe" C:\Users\test22\AppData\Local\Temp\FnrTI.dll,OWMilsbkgGVyJL
4140
rundll32.exe "C:\Windows\System32\rundll32.exe" C:\Users\test22\AppData\Local\Temp\FnrTI.dll,OguxguFiYSHz
4244
rundll32.exe "C:\Windows\System32\rundll32.exe" C:\Users\test22\AppData\Local\Temp\FnrTI.dll,PHzWjRI
4360
rundll32.exe "C:\Windows\System32\rundll32.exe" C:\Users\test22\AppData\Local\Temp\FnrTI.dll,PNJeVrAcZDAW
4460
rundll32.exe "C:\Windows\System32\rundll32.exe" C:\Users\test22\AppData\Local\Temp\FnrTI.dll,PSDYwIgmLiVzYESIaUYrbKg
4584
rundll32.exe "C:\Windows\System32\rundll32.exe" C:\Users\test22\AppData\Local\Temp\FnrTI.dll,PiJSThSmMmzNNC
4684
rundll32.exe "C:\Windows\System32\rundll32.exe" C:\Users\test22\AppData\Local\Temp\FnrTI.dll,PneIJqdSVVerltCm
4804
rundll32.exe "C:\Windows\System32\rundll32.exe" C:\Users\test22\AppData\Local\Temp\FnrTI.dll,PpsLezsCiHiCVkHmZP
4920
rundll32.exe "C:\Windows\System32\rundll32.exe" C:\Users\test22\AppData\Local\Temp\FnrTI.dll,PuoUVwFKYxjCqT
5036
rundll32.exe "C:\Windows\System32\rundll32.exe" C:\Users\test22\AppData\Local\Temp\FnrTI.dll,PwNlKX
4120
rundll32.exe "C:\Windows\System32\rundll32.exe" C:\Users\test22\AppData\Local\Temp\FnrTI.dll,QRkaVvgiLqTCjGKy
4316
rundll32.exe "C:\Windows\System32\rundll32.exe" C:\Users\test22\AppData\Local\Temp\FnrTI.dll,RJAcdfSthTv
4480
rundll32.exe "C:\Windows\System32\rundll32.exe" C:\Users\test22\AppData\Local\Temp\FnrTI.dll,RYkwsDq
4636
rundll32.exe "C:\Windows\System32\rundll32.exe" C:\Users\test22\AppData\Local\Temp\FnrTI.dll,RZtKxjO
4792
rundll32.exe "C:\Windows\System32\rundll32.exe" C:\Users\test22\AppData\Local\Temp\FnrTI.dll,RcnQoaySRBXJxsiZQIHxe
4964
rundll32.exe "C:\Windows\System32\rundll32.exe" C:\Users\test22\AppData\Local\Temp\FnrTI.dll,RdnXeofUSzEDgzxXeW
3432
rundll32.exe "C:\Windows\System32\rundll32.exe" C:\Users\test22\AppData\Local\Temp\FnrTI.dll,RfsPQSmuvBYXfIScfOT
4408
rundll32.exe "C:\Windows\System32\rundll32.exe" C:\Users\test22\AppData\Local\Temp\FnrTI.dll,RkfakVk
4596
rundll32.exe "C:\Windows\System32\rundll32.exe" C:\Users\test22\AppData\Local\Temp\FnrTI.dll,RmhqixPgftgQ
4528
rundll32.exe "C:\Windows\System32\rundll32.exe" C:\Users\test22\AppData\Local\Temp\FnrTI.dll,SInCoGYrouPZGmYYJGKIR
5088
rundll32.exe "C:\Windows\System32\rundll32.exe" C:\Users\test22\AppData\Local\Temp\FnrTI.dll,SRXSueHCT
4444
rundll32.exe "C:\Windows\System32\rundll32.exe" C:\Users\test22\AppData\Local\Temp\FnrTI.dll,SVlQsYSAXEyhEvVkdWdX
4760
rundll32.exe "C:\Windows\System32\rundll32.exe" C:\Users\test22\AppData\Local\Temp\FnrTI.dll,SnLgFTA
4864
rundll32.exe "C:\Windows\System32\rundll32.exe" C:\Users\test22\AppData\Local\Temp\FnrTI.dll,SxfQZPkEOIcG
792
rundll32.exe "C:\Windows\System32\rundll32.exe" C:\Users\test22\AppData\Local\Temp\FnrTI.dll,TJZCJgp
4788
rundll32.exe "C:\Windows\System32\rundll32.exe" C:\Users\test22\AppData\Local\Temp\FnrTI.dll,TSNqZL
4292
rundll32.exe "C:\Windows\System32\rundll32.exe" C:\Users\test22\AppData\Local\Temp\FnrTI.dll,TfpEQJjWUDp
5052
rundll32.exe "C:\Windows\System32\rundll32.exe" C:\Users\test22\AppData\Local\Temp\FnrTI.dll,TvUVDsEcInyvKdGRA
4620
rundll32.exe "C:\Windows\System32\rundll32.exe" C:\Users\test22\AppData\Local\Temp\FnrTI.dll,TvtXyQtNShHDYCMvH
4664
rundll32.exe "C:\Windows\System32\rundll32.exe" C:\Users\test22\AppData\Local\Temp\FnrTI.dll,UGXSNpc
5136
rundll32.exe "C:\Windows\System32\rundll32.exe" C:\Users\test22\AppData\Local\Temp\FnrTI.dll,ULOMXGiV
5240
rundll32.exe "C:\Windows\System32\rundll32.exe" C:\Users\test22\AppData\Local\Temp\FnrTI.dll,UVzHIeChKCEwTMG
5372
rundll32.exe "C:\Windows\System32\rundll32.exe" C:\Users\test22\AppData\Local\Temp\FnrTI.dll,UagSsmENTltTUKpktiEuRJfE
5484
rundll32.exe "C:\Windows\System32\rundll32.exe" C:\Users\test22\AppData\Local\Temp\FnrTI.dll,UbjFSQJG
5604
rundll32.exe "C:\Windows\System32\rundll32.exe" C:\Users\test22\AppData\Local\Temp\FnrTI.dll,UjDfVglhgynLAuMpwrtpXkH
5724
rundll32.exe "C:\Windows\System32\rundll32.exe" C:\Users\test22\AppData\Local\Temp\FnrTI.dll,UrxprELRNWbXXBuOJlJ
5832
rundll32.exe "C:\Windows\System32\rundll32.exe" C:\Users\test22\AppData\Local\Temp\FnrTI.dll,VXDuMBzruSCyfbAMzIrvV
5952
rundll32.exe "C:\Windows\System32\rundll32.exe" C:\Users\test22\AppData\Local\Temp\FnrTI.dll,VcrtEzpxSRmZr
6096
rundll32.exe "C:\Windows\System32\rundll32.exe" C:\Users\test22\AppData\Local\Temp\FnrTI.dll,VkRjra
5180
rundll32.exe "C:\Windows\System32\rundll32.exe" C:\Users\test22\AppData\Local\Temp\FnrTI.dll,WMxfpgNLwoiQTZjkM
5208
rundll32.exe "C:\Windows\System32\rundll32.exe" C:\Users\test22\AppData\Local\Temp\FnrTI.dll,WjtCBeYwDkRZvKLfJD
5468
rundll32.exe "C:\Windows\System32\rundll32.exe" C:\Users\test22\AppData\Local\Temp\FnrTI.dll,XoMiJXhdBRBldnkLkgMM
5640
rundll32.exe "C:\Windows\System32\rundll32.exe" C:\Users\test22\AppData\Local\Temp\FnrTI.dll,XsBeDFcmOsaqRihqMytJ
5828
rundll32.exe "C:\Windows\System32\rundll32.exe" C:\Users\test22\AppData\Local\Temp\FnrTI.dll,YGPQhuvjFbQXSoJfVilOnVw
5992
rundll32.exe "C:\Windows\System32\rundll32.exe" C:\Users\test22\AppData\Local\Temp\FnrTI.dll,YvzKAJK
6076
rundll32.exe "C:\Windows\System32\rundll32.exe" C:\Users\test22\AppData\Local\Temp\FnrTI.dll,ZAppiYnp
5296
rundll32.exe "C:\Windows\System32\rundll32.exe" C:\Users\test22\AppData\Local\Temp\FnrTI.dll,ZXZEfUeKC
5556
rundll32.exe "C:\Windows\System32\rundll32.exe" C:\Users\test22\AppData\Local\Temp\FnrTI.dll,ZoyjBLvuBnIxXaWxFC
5816
rundll32.exe "C:\Windows\System32\rundll32.exe" C:\Users\test22\AppData\Local\Temp\FnrTI.dll,aZwlVZLRtCIfDmaYbAXR
6044
rundll32.exe "C:\Windows\System32\rundll32.exe" C:\Users\test22\AppData\Local\Temp\FnrTI.dll,bdnAzUNoMZJXxzHG
5264
rundll32.exe "C:\Windows\System32\rundll32.exe" C:\Users\test22\AppData\Local\Temp\FnrTI.dll,btmsIKQVm
5292
rundll32.exe "C:\Windows\System32\rundll32.exe" C:\Users\test22\AppData\Local\Temp\FnrTI.dll,cFminOM
5976
rundll32.exe "C:\Windows\System32\rundll32.exe" C:\Users\test22\AppData\Local\Temp\FnrTI.dll,cKjOEfqQYYQ
5416
rundll32.exe "C:\Windows\System32\rundll32.exe" C:\Users\test22\AppData\Local\Temp\FnrTI.dll,czIvuAZ
5620
rundll32.exe "C:\Windows\System32\rundll32.exe" C:\Users\test22\AppData\Local\Temp\FnrTI.dll,dMEJcsHSUiODu
5696
rundll32.exe "C:\Windows\System32\rundll32.exe" C:\Users\test22\AppData\Local\Temp\FnrTI.dll,dPYgmMRi
6128
rundll32.exe "C:\Windows\System32\rundll32.exe" C:\Users\test22\AppData\Local\Temp\FnrTI.dll,dStUmppUwHfwVxtCgCewXt
5204
rundll32.exe "C:\Windows\System32\rundll32.exe" C:\Users\test22\AppData\Local\Temp\FnrTI.dll,deMXieymThIxfyWzHCMb
6056
rundll32.exe "C:\Windows\System32\rundll32.exe" C:\Users\test22\AppData\Local\Temp\FnrTI.dll,dgCMMkwNpUNZ
6200
rundll32.exe "C:\Windows\System32\rundll32.exe" C:\Users\test22\AppData\Local\Temp\FnrTI.dll,eDtAbxMTINFwGjIRymBKxBFTe
6316
rundll32.exe "C:\Windows\System32\rundll32.exe" C:\Users\test22\AppData\Local\Temp\FnrTI.dll,ePfrWQkHuKqOV
6416
rundll32.exe "C:\Windows\System32\rundll32.exe" C:\Users\test22\AppData\Local\Temp\FnrTI.dll,eQnPJdIEwUrOjHyYKajVY
6536
rundll32.exe "C:\Windows\System32\rundll32.exe" C:\Users\test22\AppData\Local\Temp\FnrTI.dll,eWqtOcNgKbDEwKynrCTAaqRd
6636
rundll32.exe "C:\Windows\System32\rundll32.exe" C:\Users\test22\AppData\Local\Temp\FnrTI.dll,eiRJXgFAjkyObQxtC
6764
rundll32.exe "C:\Windows\System32\rundll32.exe" C:\Users\test22\AppData\Local\Temp\FnrTI.dll,fLsjxmtTmthGKPw
6884
rundll32.exe "C:\Windows\System32\rundll32.exe" C:\Users\test22\AppData\Local\Temp\FnrTI.dll,fqsAeZLb
7008
rundll32.exe "C:\Windows\System32\rundll32.exe" C:\Users\test22\AppData\Local\Temp\FnrTI.dll,frkkGhhTKCPBzCLoveBHn
7104
rundll32.exe "C:\Windows\System32\rundll32.exe" C:\Users\test22\AppData\Local\Temp\FnrTI.dll,fxmvSQNzSiXj
5744
rundll32.exe "C:\Windows\System32\rundll32.exe" C:\Users\test22\AppData\Local\Temp\FnrTI.dll,gATjvjWkzNfdmAJbeFMKFtUmoI
6380
rundll32.exe "C:\Windows\System32\rundll32.exe" C:\Users\test22\AppData\Local\Temp\FnrTI.dll,gCFmNdxvaAq
6492
rundll32.exe "C:\Windows\System32\rundll32.exe" C:\Users\test22\AppData\Local\Temp\FnrTI.dll,gfeRIwKkCZUnQQ
6680
rundll32.exe "C:\Windows\System32\rundll32.exe" C:\Users\test22\AppData\Local\Temp\FnrTI.dll,gjZENXkR
6744
rundll32.exe "C:\Windows\System32\rundll32.exe" C:\Users\test22\AppData\Local\Temp\FnrTI.dll,gzzlrzxMlshrI
6992
rundll32.exe "C:\Windows\System32\rundll32.exe" C:\Users\test22\AppData\Local\Temp\FnrTI.dll,hClTxV
6248
rundll32.exe "C:\Windows\System32\rundll32.exe" C:\Users\test22\AppData\Local\Temp\FnrTI.dll,hDdSABujeGhBdM
6552
rundll32.exe "C:\Windows\System32\rundll32.exe" C:\Users\test22\AppData\Local\Temp\FnrTI.dll,hJbRrovBnfzadHBLOAaX
6692
rundll32.exe "C:\Windows\System32\rundll32.exe" C:\Users\test22\AppData\Local\Temp\FnrTI.dll,hLNWWET
6972
rundll32.exe "C:\Windows\System32\rundll32.exe" C:\Users\test22\AppData\Local\Temp\FnrTI.dll,iIJmtODVuCFQPMFae
6184
rundll32.exe "C:\Windows\System32\rundll32.exe" C:\Users\test22\AppData\Local\Temp\FnrTI.dll,iItzzFKWzIZojfOFqJG
6620
rundll32.exe "C:\Windows\System32\rundll32.exe" C:\Users\test22\AppData\Local\Temp\FnrTI.dll,ibqesePIQXoUwnfgkLvfcuMFHK
6900
rundll32.exe "C:\Windows\System32\rundll32.exe" C:\Users\test22\AppData\Local\Temp\FnrTI.dll,ieuLWaTjVeuBYegSaGXuly
5340
rundll32.exe "C:\Windows\System32\rundll32.exe" C:\Users\test22\AppData\Local\Temp\FnrTI.dll,igFffrhNCQcHQStroQFS
6668
rundll32.exe "C:\Windows\System32\rundll32.exe" C:\Users\test22\AppData\Local\Temp\FnrTI.dll,irtTnxRuuXAWDuDRGCivHz
6364
rundll32.exe "C:\Windows\System32\rundll32.exe" C:\Users\test22\AppData\Local\Temp\FnrTI.dll,jVNpFjHcSQ
6728
rundll32.exe "C:\Windows\System32\rundll32.exe" C:\Users\test22\AppData\Local\Temp\FnrTI.dll,jotleypmamgIHEUfZPLSmMtq
7100
rundll32.exe "C:\Windows\System32\rundll32.exe" C:\Users\test22\AppData\Local\Temp\FnrTI.dll,jrkFXlWfdhOn
6740
rundll32.exe "C:\Windows\System32\rundll32.exe" C:\Users\test22\AppData\Local\Temp\FnrTI.dll,kOcvjMhVkKI
7220
rundll32.exe "C:\Windows\System32\rundll32.exe" C:\Users\test22\AppData\Local\Temp\FnrTI.dll,kPsHiOxOlxeVBpHYooACxIXHB
7320
rundll32.exe "C:\Windows\System32\rundll32.exe" C:\Users\test22\AppData\Local\Temp\FnrTI.dll,kUHyuFSDHjRQgcFnZIHgvahta
7452
rundll32.exe "C:\Windows\System32\rundll32.exe" C:\Users\test22\AppData\Local\Temp\FnrTI.dll,kXMermOELWqc
7580
rundll32.exe "C:\Windows\System32\rundll32.exe" C:\Users\test22\AppData\Local\Temp\FnrTI.dll,kkWRnVCjitIbHTy
7676
rundll32.exe "C:\Windows\System32\rundll32.exe" C:\Users\test22\AppData\Local\Temp\FnrTI.dll,kpoFTDgQJFpD
7800
rundll32.exe "C:\Windows\System32\rundll32.exe" C:\Users\test22\AppData\Local\Temp\FnrTI.dll,kvCgXPvHuWWWdAHGy
7920
rundll32.exe "C:\Windows\System32\rundll32.exe" C:\Users\test22\AppData\Local\Temp\FnrTI.dll,lFcjChjFWgKWuOuaAxn
8020
rundll32.exe "C:\Windows\System32\rundll32.exe" C:\Users\test22\AppData\Local\Temp\FnrTI.dll,lKFTvqNg
8136
rundll32.exe "C:\Windows\System32\rundll32.exe" C:\Users\test22\AppData\Local\Temp\FnrTI.dll,lcbnVGCdYXcKZTYevsVX
7236
rundll32.exe "C:\Windows\System32\rundll32.exe" C:\Users\test22\AppData\Local\Temp\FnrTI.dll,lefIOOsVMhliLLj
7348
rundll32.exe "C:\Windows\System32\rundll32.exe" C:\Users\test22\AppData\Local\Temp\FnrTI.dll,mKrNVAlauoRSIht
1200
rundll32.exe "C:\Windows\System32\rundll32.exe" C:\Users\test22\AppData\Local\Temp\FnrTI.dll,nRVfeUAoalGiEviupjuyTviKt
7664
rundll32.exe "C:\Windows\System32\rundll32.exe" C:\Users\test22\AppData\Local\Temp\FnrTI.dll,nWkMZMN
7832
rundll32.exe "C:\Windows\System32\rundll32.exe" C:\Users\test22\AppData\Local\Temp\FnrTI.dll,naKLRCkO
8072
rundll32.exe "C:\Windows\System32\rundll32.exe" C:\Users\test22\AppData\Local\Temp\FnrTI.dll,njUWLbQgRBGSd
7264
rundll32.exe "C:\Windows\System32\rundll32.exe" C:\Users\test22\AppData\Local\Temp\FnrTI.dll,nlBfCJTJQhnnPxbkQkUAwWpmaA
7464
rundll32.exe "C:\Windows\System32\rundll32.exe" C:\Users\test22\AppData\Local\Temp\FnrTI.dll,nmBYnmjGCq
1276
rundll32.exe "C:\Windows\System32\rundll32.exe" C:\Users\test22\AppData\Local\Temp\FnrTI.dll,oIAdOUfQaetEfqMDSL
7888
rundll32.exe "C:\Windows\System32\rundll32.exe" C:\Users\test22\AppData\Local\Temp\FnrTI.dll,osSAAvHx
8100
rundll32.exe "C:\Windows\System32\rundll32.exe" C:\Users\test22\AppData\Local\Temp\FnrTI.dll,ovwgmHjsMpOQyjNpuqeLd
7360
rundll32.exe "C:\Windows\System32\rundll32.exe" C:\Users\test22\AppData\Local\Temp\FnrTI.dll,ozpFyAlRWIHNYPuJbOLpoZosmO
7612
rundll32.exe "C:\Windows\System32\rundll32.exe" C:\Users\test22\AppData\Local\Temp\FnrTI.dll,pAbWNQjHuawouRBUprBVrXw
7816
rundll32.exe "C:\Windows\System32\rundll32.exe" C:\Users\test22\AppData\Local\Temp\FnrTI.dll,pCYRinZyYkFOxayPFyJDEDxKzO
7860
rundll32.exe "C:\Windows\System32\rundll32.exe" C:\Users\test22\AppData\Local\Temp\FnrTI.dll,pQvYHQSqPMdqFOFub
7736
rundll32.exe "C:\Windows\System32\rundll32.exe" C:\Users\test22\AppData\Local\Temp\FnrTI.dll,pbzbgZeZipMwitVYJJbYTdyYQ
8032
rundll32.exe "C:\Windows\System32\rundll32.exe" C:\Users\test22\AppData\Local\Temp\FnrTI.dll,pnbxRJnSdfpDADRIEWZXepR
7764
rundll32.exe "C:\Windows\System32\rundll32.exe" C:\Users\test22\AppData\Local\Temp\FnrTI.dll,qAirVWefWGdomxGs
7684
rundll32.exe "C:\Windows\System32\rundll32.exe" C:\Users\test22\AppData\Local\Temp\FnrTI.dll,qbgUwwXPUNM
8176
rundll32.exe "C:\Windows\System32\rundll32.exe" C:\Users\test22\AppData\Local\Temp\FnrTI.dll,rJVMJaiBojiOWxURyzmLWnxH
7716
rundll32.exe "C:\Windows\System32\rundll32.exe" C:\Users\test22\AppData\Local\Temp\FnrTI.dll,rOlGGoosrOYjYnwqSX
8268
rundll32.exe "C:\Windows\System32\rundll32.exe" C:\Users\test22\AppData\Local\Temp\FnrTI.dll,rSHUNkevMkknNwSlqR
8372
rundll32.exe "C:\Windows\System32\rundll32.exe" C:\Users\test22\AppData\Local\Temp\FnrTI.dll,rmrMOmqIIM
8500
rundll32.exe "C:\Windows\System32\rundll32.exe" C:\Users\test22\AppData\Local\Temp\FnrTI.dll,sBcaPzIWckINwkFTBxmdkiKID
8644
rundll32.exe "C:\Windows\System32\rundll32.exe" C:\Users\test22\AppData\Local\Temp\FnrTI.dll,sJXDLm
8744
rundll32.exe "C:\Windows\System32\rundll32.exe" C:\Users\test22\AppData\Local\Temp\FnrTI.dll,sNQjkxnpfL
8868
rundll32.exe "C:\Windows\System32\rundll32.exe" C:\Users\test22\AppData\Local\Temp\FnrTI.dll,sPKnvGEKVGRHsXgbRRJFS
8984
rundll32.exe "C:\Windows\System32\rundll32.exe" C:\Users\test22\AppData\Local\Temp\FnrTI.dll,snoSMpnSAlGCDUoadZDE
9108
rundll32.exe "C:\Windows\System32\rundll32.exe" C:\Users\test22\AppData\Local\Temp\FnrTI.dll,tGDiqYCDbgMaBXHmxqrJv
7796
rundll32.exe "C:\Windows\System32\rundll32.exe" C:\Users\test22\AppData\Local\Temp\FnrTI.dll,tGdwKquShaUWskzgERPqeG
8384
rundll32.exe "C:\Windows\System32\rundll32.exe" C:\Users\test22\AppData\Local\Temp\FnrTI.dll,tXncljehbaR
8596
rundll32.exe "C:\Windows\System32\rundll32.exe" C:\Users\test22\AppData\Local\Temp\FnrTI.dll,taNCAYWnFedga
8740
rundll32.exe "C:\Windows\System32\rundll32.exe" C:\Users\test22\AppData\Local\Temp\FnrTI.dll,uFBMgXMRHfYmHKtd
8904
rundll32.exe "C:\Windows\System32\rundll32.exe" C:\Users\test22\AppData\Local\Temp\FnrTI.dll,uQadijPTgYiRGTkxDpqTOeI
9068
rundll32.exe "C:\Windows\System32\rundll32.exe" C:\Users\test22\AppData\Local\Temp\FnrTI.dll,vlEZdJoJilVuJxGaLFCzX
9212
rundll32.exe "C:\Windows\System32\rundll32.exe" C:\Users\test22\AppData\Local\Temp\FnrTI.dll,vlPATCQWfWfv
8308
rundll32.exe "C:\Windows\System32\rundll32.exe" C:\Users\test22\AppData\Local\Temp\FnrTI.dll,vnMwerzIvV
8488
rundll32.exe "C:\Windows\System32\rundll32.exe" C:\Users\test22\AppData\Local\Temp\FnrTI.dll,wDtWqzCTVUWdqo
8948
rundll32.exe "C:\Windows\System32\rundll32.exe" C:\Users\test22\AppData\Local\Temp\FnrTI.dll,weKcSTEtgvLwNKGEWr
9188
rundll32.exe "C:\Windows\System32\rundll32.exe" C:\Users\test22\AppData\Local\Temp\FnrTI.dll,wyslQDXAh
8196
rundll32.exe "C:\Windows\System32\rundll32.exe" C:\Users\test22\AppData\Local\Temp\FnrTI.dll,xRklmHvgNdkXc
8516
rundll32.exe "C:\Windows\System32\rundll32.exe" C:\Users\test22\AppData\Local\Temp\FnrTI.dll,xbTTVacjLMTUBskAADEzpolBV
8852
rundll32.exe "C:\Windows\System32\rundll32.exe" C:\Users\test22\AppData\Local\Temp\FnrTI.dll,xbcfQIhiMJswKveISUtGpEWTr
8636
rundll32.exe "C:\Windows\System32\rundll32.exe" C:\Users\test22\AppData\Local\Temp\FnrTI.dll,ytgHNsgBKfkMoZjHI
9184
rundll32.exe "C:\Windows\System32\rundll32.exe" C:\Users\test22\AppData\Local\Temp\FnrTI.dll,zLypEkbxfdampkTf
9016
rundll32.exe "C:\Windows\System32\rundll32.exe" C:\Users\test22\AppData\Local\Temp\FnrTI.dll,ziTLFIzOnbzURBefGdA
8360
rundll32.exe "C:\Windows\System32\rundll32.exe" C:\Users\test22\AppData\Local\Temp\FnrTI.dll,
8612

Name	Response	Post-Analysis Lookup
No hosts contacted.

IP Address	Status	Action
104.168.155.143	Active	Moloch
144.202.108.116	Active	Moloch
149.56.131.28	Active	Moloch
164.90.222.65	Active	Moloch
172.105.226.75	Active	Moloch
196.218.30.83	Active	Moloch
207.148.79.14	Active	Moloch
213.239.212.5	Active	Moloch

Suricata Alerts

Flow	SID	Signature	Category
TCP 192.168.56.101:49395 -> 213.239.212.5:443	2404314	ET CNC Feodo Tracker Reported CnC Server group 15	A Network Trojan was detected
TCP 192.168.56.101:49393 -> 104.168.155.143:8080	2404301	ET CNC Feodo Tracker Reported CnC Server group 2	A Network Trojan was detected
TCP 192.168.56.101:49395 -> 213.239.212.5:443	2028401	ET JA3 Hash - Possible Malware - Various Trickbot/Kovter/Dridex	Unknown Traffic
TCP 192.168.56.101:49398 -> 172.105.226.75:8080	2028401	ET JA3 Hash - Possible Malware - Various Trickbot/Kovter/Dridex	Unknown Traffic
TCP 192.168.56.101:49405 -> 149.56.131.28:8080	2404306	ET CNC Feodo Tracker Reported CnC Server group 7	A Network Trojan was detected
TCP 172.105.226.75:8080 -> 192.168.56.101:49400	2029340	ET INFO TLS Handshake Failure	Potentially Bad Traffic
TCP 192.168.56.101:49402 -> 149.56.131.28:8080	2028401	ET JA3 Hash - Possible Malware - Various Trickbot/Kovter/Dridex	Unknown Traffic
TCP 192.168.56.101:49403 -> 149.56.131.28:8080	2028401	ET JA3 Hash - Possible Malware - Various Trickbot/Kovter/Dridex	Unknown Traffic
TCP 149.56.131.28:8080 -> 192.168.56.101:49404	2029340	ET INFO TLS Handshake Failure	Potentially Bad Traffic
TCP 192.168.56.101:49391 -> 164.90.222.65:443	2404307	ET CNC Feodo Tracker Reported CnC Server group 8	A Network Trojan was detected
TCP 192.168.56.101:49392 -> 144.202.108.116:8080	2404304	ET CNC Feodo Tracker Reported CnC Server group 5	A Network Trojan was detected
TCP 192.168.56.101:49394 -> 213.239.212.5:443	2028401	ET JA3 Hash - Possible Malware - Various Trickbot/Kovter/Dridex	Unknown Traffic
TCP 213.239.212.5:443 -> 192.168.56.101:49396	2029340	ET INFO TLS Handshake Failure	Potentially Bad Traffic
TCP 192.168.56.101:49399 -> 172.105.226.75:8080	2028401	ET JA3 Hash - Possible Malware - Various Trickbot/Kovter/Dridex	Unknown Traffic

Suricata TLS

No Suricata TLS

Queries for the computername (1 event)

Time & API	Arguments	Status	Return	Repeated
GetComputerNameA July 15, 2022, 7:52 a.m.	computer_name: TEST22-PC	1	1	0

Checks amount of memory in system, this can be used to detect virtual machines that have a low amount of memory available (1 event)

Time & API	Arguments	Status	Return	Repeated
GlobalMemoryStatusEx July 15, 2022, 7:52 a.m.		1	1	0

Allocates read-write-execute memory (usually to unpack itself) (50 out of 79 events)

Time & API	Arguments	Status
NtAllocateVirtualMemory July 15, 2022, 7:52 a.m.	process_identifier: 2304 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0000000000520000 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory July 15, 2022, 7:52 a.m.	process_identifier: 2304 region_size: 176128 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0000000000530000 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory July 15, 2022, 7:52 a.m.	process_identifier: 2304 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000000007391c000 process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory July 15, 2022, 7:52 a.m.	process_identifier: 2420 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0000000000510000 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory July 15, 2022, 7:52 a.m.	process_identifier: 2420 region_size: 176128 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0000000000520000 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory July 15, 2022, 7:52 a.m.	process_identifier: 2420 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000000007391c000 process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory July 15, 2022, 7:52 a.m.	process_identifier: 2720 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0000000001d40000 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory July 15, 2022, 7:52 a.m.	process_identifier: 2720 region_size: 176128 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0000000001eb0000 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory July 15, 2022, 7:52 a.m.	process_identifier: 2720 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000000007391c000 process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory July 15, 2022, 7:52 a.m.	process_identifier: 2516 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0000000001dc0000 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory July 15, 2022, 7:52 a.m.	process_identifier: 2516 region_size: 176128 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0000000001dd0000 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory July 15, 2022, 7:52 a.m.	process_identifier: 2516 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000000007391c000 process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory July 15, 2022, 7:52 a.m.	process_identifier: 3004 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0000000001c40000 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory July 15, 2022, 7:52 a.m.	process_identifier: 3004 region_size: 176128 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0000000001c50000 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory July 15, 2022, 7:52 a.m.	process_identifier: 3004 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000000007391c000 process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory July 15, 2022, 7:52 a.m.	process_identifier: 2924 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0000000001c40000 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory July 15, 2022, 7:52 a.m.	process_identifier: 2924 region_size: 176128 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0000000001c50000 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory July 15, 2022, 7:52 a.m.	process_identifier: 2924 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000000007391c000 process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory July 15, 2022, 7:52 a.m.	process_identifier: 3056 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0000000001eb0000 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory July 15, 2022, 7:52 a.m.	process_identifier: 3056 region_size: 176128 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0000000001ec0000 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory July 15, 2022, 7:52 a.m.	process_identifier: 3056 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000000007391c000 process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory July 15, 2022, 7:52 a.m.	process_identifier: 1304 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0000000001d40000 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory July 15, 2022, 7:52 a.m.	process_identifier: 1304 region_size: 176128 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0000000001d50000 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory July 15, 2022, 7:52 a.m.	process_identifier: 1304 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000000007391c000 process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory July 15, 2022, 7:52 a.m.	process_identifier: 2768 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0000000001dd0000 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory July 15, 2022, 7:52 a.m.	process_identifier: 2768 region_size: 176128 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0000000001de0000 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory July 15, 2022, 7:52 a.m.	process_identifier: 2768 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000000007391c000 process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory July 15, 2022, 7:52 a.m.	process_identifier: 2436 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0000000000590000 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory July 15, 2022, 7:52 a.m.	process_identifier: 2436 region_size: 176128 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00000000005a0000 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory July 15, 2022, 7:52 a.m.	process_identifier: 2436 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000000007391c000 process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory July 15, 2022, 7:52 a.m.	process_identifier: 1988 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0000000001c40000 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory July 15, 2022, 7:52 a.m.	process_identifier: 1988 region_size: 176128 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0000000001c50000 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory July 15, 2022, 7:52 a.m.	process_identifier: 1988 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000000007391c000 process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory July 15, 2022, 7:52 a.m.	process_identifier: 2744 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0000000000410000 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory July 15, 2022, 7:52 a.m.	process_identifier: 2744 region_size: 176128 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0000000000420000 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory July 15, 2022, 7:52 a.m.	process_identifier: 2744 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000000007391c000 process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory July 15, 2022, 7:52 a.m.	process_identifier: 2812 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0000000001c40000 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory July 15, 2022, 7:52 a.m.	process_identifier: 2812 region_size: 176128 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0000000001cf0000 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory July 15, 2022, 7:52 a.m.	process_identifier: 2812 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000000007391c000 process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory July 15, 2022, 7:52 a.m.	process_identifier: 2572 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0000000000310000 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory July 15, 2022, 7:52 a.m.	process_identifier: 2572 region_size: 176128 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0000000000340000 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory July 15, 2022, 7:52 a.m.	process_identifier: 2572 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000000007391c000 process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory July 15, 2022, 7:52 a.m.	process_identifier: 2884 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0000000001c40000 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory July 15, 2022, 7:52 a.m.	process_identifier: 2884 region_size: 176128 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0000000001cf0000 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory July 15, 2022, 7:52 a.m.	process_identifier: 2884 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000000007391c000 process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory July 15, 2022, 7:52 a.m.	process_identifier: 2292 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0000000001c40000 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory July 15, 2022, 7:52 a.m.	process_identifier: 2292 region_size: 176128 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0000000001df0000 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory July 15, 2022, 7:52 a.m.	process_identifier: 2292 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000000007391c000 process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory July 15, 2022, 7:52 a.m.	process_identifier: 2964 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0000000001c40000 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory July 15, 2022, 7:52 a.m.	process_identifier: 2964 region_size: 176128 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0000000001c50000 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0xffffffffffffffff	1

Creates a suspicious process (1 event)

cmdline

C:\Windows\system32\regsvr32.exe "C:\Windows\system32\MxDzSVtwfSRlLv\dnfqUgyyGIrKnZE.dll"

Searches running processes potentially to identify processes for sandbox evasion, code injection or memory dumping (50 events)

Time & API	Arguments	Status	Return
Process32FirstW July 15, 2022, 7:52 a.m.	snapshot_handle: 0x0000000000000144 process_name: [System Process] process_identifier: 0	1	1
Process32NextW July 15, 2022, 7:52 a.m.	snapshot_handle: 0x0000000000000144 process_name: System process_identifier: 4	1	1
Process32NextW July 15, 2022, 7:52 a.m.	snapshot_handle: 0x0000000000000144 process_name: smss.exe process_identifier: 224	1	1
Process32NextW July 15, 2022, 7:52 a.m.	snapshot_handle: 0x0000000000000144 process_name: csrss.exe process_identifier: 300	1	1
Process32NextW July 15, 2022, 7:52 a.m.	snapshot_handle: 0x0000000000000144 process_name: wininit.exe process_identifier: 340	1	1
Process32NextW July 15, 2022, 7:52 a.m.	snapshot_handle: 0x0000000000000144 process_name: csrss.exe process_identifier: 364	1	1
Process32NextW July 15, 2022, 7:52 a.m.	snapshot_handle: 0x0000000000000144 process_name: winlogon.exe process_identifier: 404	1	1
Process32NextW July 15, 2022, 7:52 a.m.	snapshot_handle: 0x0000000000000144 process_name: services.exe process_identifier: 440	1	1
Process32NextW July 15, 2022, 7:52 a.m.	snapshot_handle: 0x0000000000000144 process_name: lsass.exe process_identifier: 452	1	1
Process32NextW July 15, 2022, 7:52 a.m.	snapshot_handle: 0x0000000000000144 process_name: lsm.exe process_identifier: 460	1	1
Process32NextW July 15, 2022, 7:52 a.m.	snapshot_handle: 0x0000000000000144 process_name: svchost.exe process_identifier: 580	1	1
Process32NextW July 15, 2022, 7:52 a.m.	snapshot_handle: 0x0000000000000144 process_name: svchost.exe process_identifier: 656	1	1
Process32NextW July 15, 2022, 7:52 a.m.	snapshot_handle: 0x0000000000000144 process_name: svchost.exe process_identifier: 728	1	1
Process32NextW July 15, 2022, 7:52 a.m.	snapshot_handle: 0x0000000000000144 process_name: svchost.exe process_identifier: 796	1	1
Process32NextW July 15, 2022, 7:52 a.m.	snapshot_handle: 0x0000000000000144 process_name: svchost.exe process_identifier: 836	1	1
Process32NextW July 15, 2022, 7:52 a.m.	snapshot_handle: 0x0000000000000144 process_name: audiodg.exe process_identifier: 916	1	1
Process32NextW July 15, 2022, 7:52 a.m.	snapshot_handle: 0x0000000000000144 process_name: svchost.exe process_identifier: 988	1	1
Process32NextW July 15, 2022, 7:52 a.m.	snapshot_handle: 0x0000000000000144 process_name: svchost.exe process_identifier: 304	1	1
Process32NextW July 15, 2022, 7:52 a.m.	snapshot_handle: 0x0000000000000144 process_name: spoolsv.exe process_identifier: 312	1	1
Process32NextW July 15, 2022, 7:52 a.m.	snapshot_handle: 0x0000000000000144 process_name: svchost.exe process_identifier: 1044	1	1
Process32NextW July 15, 2022, 7:52 a.m.	snapshot_handle: 0x0000000000000144 process_name: taskhost.exe process_identifier: 1132	1	1
Process32NextW July 15, 2022, 7:52 a.m.	snapshot_handle: 0x0000000000000144 process_name: svchost.exe process_identifier: 1340	1	1
Process32NextW July 15, 2022, 7:52 a.m.	snapshot_handle: 0x0000000000000144 process_name: srvany.exe process_identifier: 1380	1	1
Process32NextW July 15, 2022, 7:52 a.m.	snapshot_handle: 0x0000000000000144 process_name: KMService.exe process_identifier: 1452	1	1
Process32NextW July 15, 2022, 7:52 a.m.	snapshot_handle: 0x0000000000000144 process_name: conhost.exe process_identifier: 1468	1	1
Process32NextW July 15, 2022, 7:52 a.m.	snapshot_handle: 0x0000000000000144 process_name: sppsvc.exe process_identifier: 1716	1	1
Process32NextW July 15, 2022, 7:52 a.m.	snapshot_handle: 0x0000000000000144 process_name: svchost.exe process_identifier: 1804	1	1
Process32NextW July 15, 2022, 7:52 a.m.	snapshot_handle: 0x0000000000000144 process_name: dwm.exe process_identifier: 2028	1	1
Process32NextW July 15, 2022, 7:52 a.m.	snapshot_handle: 0x0000000000000144 process_name: explorer.exe process_identifier: 1156	1	1
Process32NextW July 15, 2022, 7:52 a.m.	snapshot_handle: 0x0000000000000144 process_name: pw.exe process_identifier: 924	1	1
Process32NextW July 15, 2022, 7:52 a.m.	snapshot_handle: 0x0000000000000144 process_name: SearchIndexer.exe process_identifier: 772	1	1
Process32NextW July 15, 2022, 7:52 a.m.	snapshot_handle: 0x0000000000000144 process_name: SearchProtocolHost.exe process_identifier: 1776	1	1
Process32NextW July 15, 2022, 7:52 a.m.	snapshot_handle: 0x0000000000000144 process_name: SearchFilterHost.exe process_identifier: 1492	1	1
Process32NextW July 15, 2022, 7:52 a.m.	snapshot_handle: 0x0000000000000144 process_name: mobsync.exe process_identifier: 2348	1	1
Process32NextW July 15, 2022, 7:52 a.m.	snapshot_handle: 0x0000000000000144 process_name: pw.exe process_identifier: 2520	1	1
Process32NextW July 15, 2022, 7:52 a.m.	snapshot_handle: 0x0000000000000144 process_name: taskhost.exe process_identifier: 2612	1	1
Process32NextW July 15, 2022, 7:52 a.m.	snapshot_handle: 0x0000000000000144 process_name: SearchProtocolHost.exe process_identifier: 2708	1	1
Process32NextW July 15, 2022, 7:52 a.m.	snapshot_handle: 0x0000000000000144 process_name: rundll32.exe process_identifier: 2116	1	1
Process32NextW July 15, 2022, 7:52 a.m.	snapshot_handle: 0x0000000000000144 process_name: rundll32.exe process_identifier: 2812	1	1
Process32NextW July 15, 2022, 7:52 a.m.	snapshot_handle: 0x0000000000000154 process_name: rundll32.exe process_identifier: 3848	1	1
Process32NextW July 15, 2022, 7:52 a.m.	snapshot_handle: 0x0000000000000154 process_name: rundll32.exe process_identifier: 3948	1	1
Process32NextW July 15, 2022, 7:52 a.m.	snapshot_handle: 0x0000000000000154 process_name: rundll32.exe process_identifier: 4036	1	1
Process32NextW July 15, 2022, 7:52 a.m.	snapshot_handle: 0x0000000000000154 process_name: rundll32.exe process_identifier: 3104	1	1
Process32NextW July 15, 2022, 7:52 a.m.	snapshot_handle: 0x0000000000000154 process_name: rundll32.exe process_identifier: 3152	1	1
Process32NextW July 15, 2022, 7:52 a.m.	snapshot_handle: 0x0000000000000154 process_name: rundll32.exe process_identifier: 2400	1	1
Process32NextW July 15, 2022, 7:52 a.m.	snapshot_handle: 0x0000000000000154 process_name: rundll32.exe process_identifier: 3260	1	1
Process32NextW July 15, 2022, 7:52 a.m.	snapshot_handle: 0x0000000000000154 process_name: rundll32.exe process_identifier: 2396	1	1
Process32NextW July 15, 2022, 7:52 a.m.	snapshot_handle: 0x0000000000000154 process_name: rundll32.exe process_identifier: 3248	1	1
Process32NextW July 15, 2022, 7:52 a.m.	snapshot_handle: 0x0000000000000154 process_name: rundll32.exe process_identifier: 3640	1	1
Process32NextW July 15, 2022, 7:52 a.m.	snapshot_handle: 0x0000000000000154 process_name: regsvr32.exe process_identifier: 3724	1	1

The binary likely contains encrypted or compressed data indicative of a packer (2 events)

section

{u'size_of_data': u'0x0002be00', u'virtual_address': u'0x0001b000', u'entropy': 7.848244115365133, u'name': u'.rsrc', u'virtual_size': u'0x0002bc80'}

entropy

7.84824411537

description

A section with a high entropy has been found

entropy

0.654850746269

description

Overall entropy of this PE file is high

Expresses interest in specific running processes (2 events)

process	regsvr32.exe
process	rundll32.exe

Communicates with host for which no DNS query was performed (8 events)

host	104.168.155.143
host	144.202.108.116
host	149.56.131.28
host	164.90.222.65
host	172.105.226.75
host	196.218.30.83
host	207.148.79.14
host	213.239.212.5

Installs itself for autorun at Windows startup (1 event)

service_name

dnfqUgyyGIrKnZE.dll

service_path

C:\Windows\System32\regsvr32.exe "C:\Windows\system32\MxDzSVtwfSRlLv\dnfqUgyyGIrKnZE.dll"

Created a service where a service was also not started (1 event)

Time & API	Arguments	Status	Return	Repeated
CreateServiceW July 15, 2022, 7:52 a.m.	service_start_name: start_type: 2 password: display_name: dnfqUgyyGIrKnZE.dll filepath: C:\Windows\System32\regsvr32.exe "C:\Windows\system32\MxDzSVtwfSRlLv\dnfqUgyyGIrKnZE.dll" service_name: dnfqUgyyGIrKnZE.dll filepath_r: C:\Windows\system32\regsvr32.exe "C:\Windows\system32\MxDzSVtwfSRlLv\dnfqUgyyGIrKnZE.dll" desired_access: 2 service_handle: 0x0000000000239830 error_control: 0 service_type: 16 service_manager_handle: 0x0000000000239440	1	2332720	0

Attempts to remove evidence of file being downloaded from the Internet (1 event)

file	C:\Windows\System32\MxDzSVtwfSRlLv\dnfqUgyyGIrKnZE.dll:Zone.Identifier

File has been identified by 52 AntiVirus engines on VirusTotal as malicious (50 out of 52 events)

Lionic	Trojan.Win64.Strab.4!c
Elastic	malicious (moderate confidence)
Cynet	Malicious (score: 99)
FireEye	Generic.mg.745dac0fc6ed2014
CAT-QuickHeal	Trojan.Win64
McAfee	Emotet-FTY!745DAC0FC6ED
Malwarebytes	Trojan.Emotet
Sangfor	Trojan.Win64.Kryptik.DHR
K7AntiVirus	Trojan ( 0059554a1 )
BitDefender	Trojan.GenericKD.50608750
K7GW	Trojan ( 0059554a1 )
CrowdStrike	win/malicious_confidence_100% (W)
Arcabit	Trojan.Generic.D3043A6E
Cyren	W64/S-ec2e480c!Eldorado
Symantec	Trojan.Gen.MBT
ESET-NOD32	a variant of Win64/Kryptik.DHR
Paloalto	generic.ml
ClamAV	Win.Trojan.Emotet-9955402-0
Kaspersky	Trojan.Win64.Strab.n
Alibaba	Trojan:Win64/Strab.7b781f12
ViRobot	Trojan.Win32.Z.Emotet.275456.KB
MicroWorld-eScan	Trojan.GenericKD.50608750
Avast	Win64:BotX-gen [Trj]
Tencent	Trojan.Win64.Kryptik.zr
Ad-Aware	Trojan.GenericKD.50608750
Emsisoft	Trojan.GenericKD.50608750 (B)
Comodo	Malware@#3au9qi7krnqm3
F-Secure	Trojan.TR/Kryptik.pwmhf
DrWeb	Trojan.Emotet.1203
VIPRE	Trojan.GenericKD.50608750
TrendMicro	TrojanSpy.Win64.EMOTET.SMYXCFC
McAfee-GW-Edition	Emotet-FTY!745DAC0FC6ED
Sophos	Mal/Generic-S + Troj/Emotet-DCG
Jiangmin	Trojan.Strab.bcj
Webroot	W32.Trojan.Emotet
Avira	TR/Kryptik.pwmhf
Antiy-AVL	Trojan/Generic.ASMalwS.6C82
Kingsoft	Win32.Troj.Win64.n.(kcloud)
Microsoft	Trojan:Win64/Emotet.BY!MTB
GData	Trojan.GenericKD.50608750
AhnLab-V3	Malware/Win.FTY.R503424
VBA32	Trojan.Win64.Emotet
ALYac	Trojan.Agent.Emotet
MAX	malware (ai score=99)
Cylance	Unsafe
Rising	Trojan.Emotet/x64!1.DEEF (CLASSIC)
Yandex	Trojan.Strab!V/4HjPjRRxs
Ikarus	Trojan-Spy.Emotet
MaxSecure	Trojan.Malware.185465870.susgen
Fortinet	W64/Emotet.G!tr

Connects to IP addresses that are no longer responding to requests (legitimate services will remain up-and-running usually) (5 events)

dead_host	144.202.108.116:8080
dead_host	207.148.79.14:8080
dead_host	164.90.222.65:443
dead_host	196.218.30.83:443
dead_host	104.168.155.143:8080

FnrTI

Process Tree Toggle all

Network Toggle all

Suricata Toggle all

Suricata Alerts

Suricata TLS

Signatures Toggle All