Summary | ZeroBOX

Category	Machine	Started	Completed
FILE	s1_win7_x6403_us	Nov. 3, 2022, 1:30 p.m.	Nov. 3, 2022, 1:32 p.m.

Size	727.0KB
Type	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
MD5	`2c6d64a28e21945fa8fc13356f659bbc`
SHA256	`cf4b7a3fef2fa902d39bfb20def4c8855ef425b3a281947c691fc76ad4c1dd00`
CRC32	`09D62531`
ssdeep	`12288:ezhsu7PWe6Fth9tmzQS+37pzGIz/mXpo1z+XSjq+DsCJqzfo:ktR6rhjmzhsT/Yg6CjtJqzf`
Yara	Malicious_Library_Zero - Malicious_Library IsDLL - (no description) Win32_Trojan_Gen_1_0904B0_Zero - Win32 Trojan Emotet PE_Header_Zero - PE File Signature Win32_Trojan_Emotet_1_Zero - Win32 Trojan Emotet IsPE64 - (no description) Malicious_Packer_Zero - Malicious Packer

rundll32.exe "C:\Windows\System32\rundll32.exe" C:\Users\test22\AppData\Local\Temp\moycMR.dll,DllRegisterServer
1460
- rundll32.exe "C:\Windows\System32\rundll32.exe" C:\Users\test22\AppData\Local\Temp\moycMR.dll,DllRegisterServer
  2128
  - regsvr32.exe C:\Windows\system32\regsvr32.exe "C:\Windows\system32\UeRrnFlKTnINpx\DRjJVxuuxNrNF.dll"
    2292
rundll32.exe "C:\Windows\System32\rundll32.exe" C:\Users\test22\AppData\Local\Temp\moycMR.dll,
2064
explorer.exe C:\Windows\Explorer.EXE
1236

Name	Response	Post-Analysis Lookup
No hosts contacted.

IP Address	Status	Action
128.199.217.206	Active	Moloch
165.22.254.236	Active	Moloch
174.138.33.49	Active	Moloch
185.148.169.10	Active	Moloch
186.250.48.5	Active	Moloch
218.38.121.17	Active	Moloch
62.171.178.147	Active	Moloch
80.211.107.116	Active	Moloch

Suricata Alerts

Flow	SID	Signature	Category
TCP 192.168.56.103:49167 -> 218.38.121.17:443	2404315	ET CNC Feodo Tracker Reported CnC Server group 16	A Network Trojan was detected
TCP 192.168.56.103:49170 -> 80.211.107.116:8080	2404322	ET CNC Feodo Tracker Reported CnC Server group 23	A Network Trojan was detected
TCP 192.168.56.103:49173 -> 185.148.169.10:8080	2404309	ET CNC Feodo Tracker Reported CnC Server group 10	A Network Trojan was detected
TCP 218.38.121.17:443 -> 192.168.56.103:49168	2029340	ET INFO TLS Handshake Failure	Potentially Bad Traffic
TCP 192.168.56.103:49171 -> 174.138.33.49:7080	2404307	ET CNC Feodo Tracker Reported CnC Server group 8	A Network Trojan was detected

Suricata TLS

No Suricata TLS

Queries for the computername (1 event)

Time & API	Arguments	Status	Return	Repeated
GetComputerNameA Nov. 3, 2022, 1:23 p.m.	computer_name: TEST22-PC	1	1	0

Checks if process is being debugged by a debugger (1 event)

Time & API	Arguments	Status	Return	Repeated
IsDebuggerPresent Nov. 3, 2022, 1:23 p.m.			0	0

Allocates read-write-execute memory (usually to unpack itself) (24 events)

Time & API	Arguments	Status
NtAllocateVirtualMemory Nov. 3, 2022, 1:23 p.m.	process_identifier: 2128 region_size: 188416 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0000000001c30000 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory Nov. 3, 2022, 1:23 p.m.	process_identifier: 2128 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0000000001c00000 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory Nov. 3, 2022, 1:23 p.m.	process_identifier: 1236 region_size: 65536 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00000000049d0000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory Nov. 3, 2022, 1:23 p.m.	process_identifier: 2292 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fef3ef5000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory Nov. 3, 2022, 1:23 p.m.	process_identifier: 2292 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fefb941000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory Nov. 3, 2022, 1:23 p.m.	process_identifier: 2292 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fefe52d000 process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory Nov. 3, 2022, 1:23 p.m.	process_identifier: 2292 region_size: 188416 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0000000001dd0000 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory Nov. 3, 2022, 1:23 p.m.	process_identifier: 2292 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0000000001e00000 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory Nov. 3, 2022, 1:23 p.m.	process_identifier: 2292 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fefd517000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory Nov. 3, 2022, 1:23 p.m.	process_identifier: 2292 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fefddaf000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory Nov. 3, 2022, 1:23 p.m.	process_identifier: 2292 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fefdbc9000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory Nov. 3, 2022, 1:23 p.m.	process_identifier: 2292 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 8192 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0000000077400000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory Nov. 3, 2022, 1:23 p.m.	process_identifier: 2292 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00000000774de000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory Nov. 3, 2022, 1:23 p.m.	process_identifier: 2292 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00000000771d0000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory Nov. 3, 2022, 1:23 p.m.	process_identifier: 2292 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fef915c000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory Nov. 3, 2022, 1:23 p.m.	process_identifier: 2292 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fef90db000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory Nov. 3, 2022, 1:23 p.m.	process_identifier: 2292 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fefbd0a000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory Nov. 3, 2022, 1:23 p.m.	process_identifier: 2292 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fefe471000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory Nov. 3, 2022, 1:23 p.m.	process_identifier: 2292 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007feff9a3000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory Nov. 3, 2022, 1:23 p.m.	process_identifier: 2292 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fefd3b1000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory Nov. 3, 2022, 1:23 p.m.	process_identifier: 2292 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fefcf81000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory Nov. 3, 2022, 1:23 p.m.	process_identifier: 2292 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fefd394000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory Nov. 3, 2022, 1:23 p.m.	process_identifier: 2292 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fefd20e000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory Nov. 3, 2022, 1:23 p.m.	process_identifier: 2292 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fefd183000 process_handle: 0xffffffffffffffff	1

Creates a suspicious process (1 event)

cmdline

C:\Windows\system32\regsvr32.exe "C:\Windows\system32\UeRrnFlKTnINpx\DRjJVxuuxNrNF.dll"

Searches running processes potentially to identify processes for sandbox evasion, code injection or memory dumping (6 events)

Time & API	Arguments	Status	Return
Process32NextW Nov. 3, 2022, 1:23 p.m.	snapshot_handle: 0x0000000000000124 process_name: mobsync.exe process_identifier: 1044	1	1
Process32NextW Nov. 3, 2022, 1:23 p.m.	snapshot_handle: 0x0000000000000124 process_name: taskhost.exe process_identifier: 1540	1	1
Process32NextW Nov. 3, 2022, 1:23 p.m.	snapshot_handle: 0x0000000000000124 process_name: SearchProtocolHost.exe process_identifier: 1516	1	1
Process32NextW Nov. 3, 2022, 1:23 p.m.	snapshot_handle: 0x0000000000000124 process_name: SearchFilterHost.exe process_identifier: 1532	1	1
Process32NextW Nov. 3, 2022, 1:23 p.m.	snapshot_handle: 0x0000000000000124 process_name: rundll32.exe process_identifier: 1460	1	1
Process32NextW Nov. 3, 2022, 1:23 p.m.	snapshot_handle: 0x0000000000000124 process_name: rundll32.exe process_identifier: 2128	1	1

The binary likely contains encrypted or compressed data indicative of a packer (2 events)

section

{u'size_of_data': u'0x00030400', u'virtual_address': u'0x0007c000', u'entropy': 7.6762144664644945, u'name': u'.data', u'virtual_size': u'0x000364b0'}

entropy

7.67621446646

description

A section with a high entropy has been found

entropy

0.265840220386

description

Overall entropy of this PE file is high

Expresses interest in specific running processes (2 events)

process	regsvr32.exe
process	rundll32.exe

Communicates with host for which no DNS query was performed (8 events)

host	128.199.217.206
host	165.22.254.236
host	174.138.33.49
host	185.148.169.10
host	186.250.48.5
host	218.38.121.17
host	62.171.178.147
host	80.211.107.116

Attempts to remove evidence of file being downloaded from the Internet (1 event)

file	C:\Windows\System32\UeRrnFlKTnINpx\DRjJVxuuxNrNF.dll:Zone.Identifier

Connects to IP addresses that are no longer responding to requests (legitimate services will remain up-and-running usually) (11 events)

dead_host	128.199.217.206:443
dead_host	174.138.33.49:7080
dead_host	62.171.178.147:8080
dead_host	80.211.107.116:8080
dead_host	192.168.56.103:49174
dead_host	185.148.169.10:8080
dead_host	192.168.56.103:49173
dead_host	192.168.56.103:49172
dead_host	192.168.56.103:49175
dead_host	165.22.254.236:8080
dead_host	186.250.48.5:443

moycMR

Process Tree Toggle all

Network Toggle all

Suricata Toggle all

Suricata Alerts

Suricata TLS

Signatures Toggle All