popup
Summary | ZeroBOX
  1. Home
  2. Result
  3. Report
  4. Detail Analysis

krnl_connect.exe

Emotet Gen1 Formbook Generic Malware Hide_EXE SUSP_Certificate_file UPX Malicious Library Malicious Packer PE64 PE File CAB
  1. Resubmit sample
Category Machine Started Completed
FILE s1_win7_x6401 Dec. 21, 2022, 5:42 p.m. Dec. 21, 2022, 5:50 p.m.
Size 815.0KB
Type PE32+ executable (GUI) x86-64, for MS Windows
MD5 d2e78f6663b47a7ec04a4d014cab5ff1
SHA256 acb5fd38a1242912e31423cb90abddbd78cb39ed19efe4768b70af99092f1328
CRC32 E15B7493
ssdeep 12288:6gy90wnQoGlU9coZ7u0pkk8oiezBswA3ptpsVjCk/TG:5y9pWU9j7u0+3Its73zpshCk/a
PDB Path wextract.pdb
Yara
  • Malicious_Library_Zero - Malicious_Library
  • Win32_Trojan_Gen_1_0904B0_Zero - Win32 Trojan Emotet
  • CAB_file_format - CAB archive file
  • PE_Header_Zero - PE File Signature
  • IsPE64 - (no description)
  • UPX_Zero - UPX packed file
  • Win32_Trojan_Emotet_RL_Gen_Zero - Win32 Trojan Emotet

Name Response Post-Analysis Lookup
No hosts contacted.
IP Address Status Action
104.18.114.97 Active Moloch
172.67.160.130 Active Moloch

Suricata Alerts

No Suricata Alerts

Suricata TLS

No Suricata TLS

pdb_path wextract.pdb
Time & API Arguments Status Return Repeated

GlobalMemoryStatusEx

 1 1 0
resource name AVI
Time & API Arguments Status Return Repeated

__exception__

 stacktrace: 
CtfImeIsIME+0x8530 TF_IsCtfmonRunning-0xe28 msctf+0x4a278 @ 0x7fefee9a278
TF_IsCtfmonRunning+0x2f4 TF_RunInputCPL-0x1a19c msctf+0x4b394 @ 0x7fefee9b394
SetInputScope+0x4662 DllRegisterServer-0x10f5e msctf+0x2e1e2 @ 0x7fefee7e1e2
TF_GetInputScope+0x19f3 CtfImeDestroyThreadMgr-0x20a9 msctf+0x14bcb @ 0x7fefee64bcb
TF_GetInputScope+0x2ae9 CtfImeDestroyThreadMgr-0xfb3 msctf+0x15cc1 @ 0x7fefee65cc1
TF_CanUninitialize+0x74 CtfNotifyIME-0x1318 msctf+0x21ea4 @ 0x7fefee71ea4
TF_CleanUpPrivateMessages+0xf48 DllGetClassObject-0x514 msctf+0x180d4 @ 0x7fefee680d4
TF_CleanUpPrivateMessages+0xf26 DllGetClassObject-0x536 msctf+0x180b2 @ 0x7fefee680b2
TF_CleanUpPrivateMessages+0xc7b DllGetClassObject-0x7e1 msctf+0x17e07 @ 0x7fefee67e07
TF_CleanUpPrivateMessages+0xbb8 DllGetClassObject-0x8a4 msctf+0x17d44 @ 0x7fefee67d44
RtlProcessFlsData+0x84 LdrUnlockLoaderLock-0x7c ntdll+0x2b894 @ 0x76d5b894
LdrShutdownProcess+0xa9 NtdllDialogWndProc_W-0x43b ntdll+0x24249 @ 0x76d54249
RtlExitUserProcess+0x90 LdrShutdownProcess-0x20 ntdll+0x24180 @ 0x76d54180
strncpy_s+0x14a exit-0x92 msvcrt+0x9962 @ 0x7fefdaf9962
krnl_connect+0x7b7e @ 0x13f8d7b7e
BaseThreadInitThunk+0xd CreateThread-0x53 kernel32+0x1652d @ 0x76c2652d
RtlUserThreadStart+0x21 strchr-0x3df ntdll+0x2c521 @ 0x76d5c521

exception.instruction_r: ff 50 18 89 9e f8 08 00 00 48 3b fb 74 28 48 39
exception.symbol: CtfImeIsIME+0x8530 TF_IsCtfmonRunning-0xe28 msctf+0x4a278
exception.instruction: call qword ptr [rax + 0x18]
exception.module: MSCTF.dll
exception.exception_code: 0xc0000005
exception.offset: 303736
exception.address: 0x7fefee9a278
registers.r14: 0
registers.r15: 0
registers.rcx: 50312160
registers.rsi: 0
registers.r10: 1
registers.rbx: 0
registers.rsp: 719296
registers.r11: 0
registers.r8: 717840
registers.r9: 0
registers.rdx: 0
registers.r12: 0
registers.rbp: 0
registers.rdi: 0
registers.rax: 1950540584
registers.r13: 0
1 0 0
Time & API Arguments Status Return Repeated

NtProtectVirtualMemory

 process_identifier: 2548
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x0000000074518000
process_handle: 0xffffffffffffffff
1 0 0

NtProtectVirtualMemory

 process_identifier: 2548
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x0000000074429000
process_handle: 0xffffffffffffffff
1 0 0

NtProtectVirtualMemory

 process_identifier: 2548
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x0000000074337000
process_handle: 0xffffffffffffffff
1 0 0

NtProtectVirtualMemory

 process_identifier: 2548
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x00000000742e9000
process_handle: 0xffffffffffffffff
1 0 0
file C:\Users\test22\AppData\Local\Temp\IXP000.TMP\certutil.exe
section {u'size_of_data': u'0x000c1600', u'virtual_address': u'0x0000f000', u'entropy': 7.939520189331764, u'name': u'.rsrc', u'virtual_size': u'0x000c2000'} entropy 7.93952018933 description A section with a high entropy has been found
entropy 0.950245700246 description Overall entropy of this PE file is high
host 104.18.114.97
host 172.67.160.130
reg_key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 reg_value rundll32.exe C:\Windows\system32\advpack.dll,DelNodeRunDLL32 "C:\Users\test22\AppData\Local\Temp\IXP000.TMP\"
Lionic Trojan.Win32.Reline.4!c
Elastic malicious (high confidence)
Cynet Malicious (score: 99)
FireEye Generic.mg.d2e78f6663b47a7e
McAfee Artemis!D2E78F6663B4
Cylance Unsafe
VIPRE Gen:Heur.PHM.1
Sangfor Trojan.Msil.Agent.Apri
Alibaba TrojanPSW:MSIL/Reline.54aa7ae2
Cybereason malicious.663b47
Arcabit Heur.BZC.VAF.Cheetah.4.09832513
Symantec ML.Attribute.HighConfidence
ESET-NOD32 a variant of MSIL/Spy.RedLine.A
APEX Malicious
Avast Other:Malware-gen [Trj]
ClamAV Txt.File.EXEinPEM-7099209-0
Kaspersky UDS:DangerousObject.Multi.Generic
BitDefender Heur.BZC.VAF.Cheetah.4.09832513
SUPERAntiSpyware Trojan.Agent/Gen-Dropper
MicroWorld-eScan Heur.BZC.VAF.Cheetah.4.09832513
Tencent Msil.Trojan-QQPass.QQRob.Timw
Ad-Aware Heur.BZC.VAF.Cheetah.4.09832513
Emsisoft Heur.BZC.VAF.Cheetah.4.09832513 (B)
F-Secure Trojan.TR/Dropper.Gen2
McAfee-GW-Edition Artemis!Trojan
Trapmine malicious.high.ml.score
Sophos Mal/Generic-S
Avira TR/Dropper.Gen2
MAX malware (ai score=81)
Kingsoft Win32.PSWTroj.Undef.(kcloud)
Microsoft Trojan:Win32/Wacatac.B!ml
ZoneAlarm HEUR:Trojan-PSW.MSIL.Reline.gen
GData Heur.BZC.VAF.Cheetah.4.09832513
Google Detected
Acronis suspicious
ALYac Heur.BZC.VAF.Cheetah.4.09832513
Rising Spyware.RedLine!8.1309C (CLOUD)
MaxSecure Trojan.Malware.300983.susgen
AVG Other:Malware-gen [Trj]