popup
Summary | ZeroBOX
  1. Home
  2. Result
  3. Report
  4. Detail Analysis

2701.exe

Emotet Gen1 Generic Malware UPX Malicious Library Malicious Packer PE64 PE File OS Processor Check PE32 .NET EXE DLL
  1. Resubmit sample
Category Machine Started Completed
FILE s1_win7_x6403_us March 11, 2023, 10:27 a.m. March 11, 2023, 10:36 a.m.
Size 1.4MB
Type PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
MD5 97201c944dcd7e82672458514a67a7b5
SHA256 0c802565c73fd2fd624ecab818162f8873935308ebc95f3b17fa74a6c582db12
CRC32 54F6A3B8
ssdeep 24576:BdnSOXpaWQoCs7Gzxdnhk6d55xedwiNaE9Jvo6jEsAfdyn1f0IEI0ICERltNGnXj:BdnSOXpaWQoCsaz7B55Mf9Jvo6q
Yara
  • Is_DotNET_EXE - (no description)
  • Win_Backdoor_AsyncRAT_Zero - Win Backdoor AsyncRAT
  • IsPE32 - (no description)
  • PE_Header_Zero - PE File Signature

Name Response Post-Analysis Lookup
j.ffbbjjkk.com
A 104.21.8.227
A 172.67.158.22
104.21.8.227
IP Address Status Action
164.124.101.2 Active Moloch
172.67.158.22 Active Moloch

Suricata Alerts

Flow SID Signature Category
TCP 192.168.56.103:49164 -> 172.67.158.22:443 906200054 SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) undefined

Suricata TLS

Flow Issuer Subject Fingerprint
TLSv1
192.168.56.103:49164
172.67.158.22:443 		C=US, O=Google Trust Services LLC, CN=GTS CA 1P5 CN=*.ffbbjjkk.com 8a:a5:6d:82:a6:a0:20:43:b2:b0:7e:aa:9a:9f:c2:ad:00:dd:fe:84

Time & API Arguments Status Return Repeated

GetComputerNameA

 computer_name: TEST22-PC
1 1 0

GetComputerNameW

 computer_name: TEST22-PC
1 1 0

GetComputerNameW

 computer_name: TEST22-PC
1 1 0
Time & API Arguments Status Return Repeated

IsDebuggerPresent

 0 0

IsDebuggerPresent

 0 0

IsDebuggerPresent

 0 0

IsDebuggerPresent

 0 0
Time & API Arguments Status Return Repeated

GlobalMemoryStatusEx

 1 1 0
Time & API Arguments Status Return Repeated

__exception__

 stacktrace: 
lgz+0x23ee @ 0x4023ee

exception.instruction_r: 8b 00 8b 00 8b 40 10 8b 55 20 8b 12 c7 44 24 14
exception.symbol: New___wmi___IWbemServices_ExecMethod@32+0x2a3 New___wmi___IWbemServices_ExecMethodAsync@28-0xde
exception.instruction: mov eax, dword ptr [eax]
exception.module: monitor-x86.dll
exception.exception_code: 0xc0000005
exception.offset: 66639
exception.address: 0x7469044f
registers.esp: 1634368
registers.edi: 6051436
registers.eax: 0
registers.ebp: 1634824
registers.edx: 1634060
registers.ebx: 0
registers.esi: 1634916
registers.ecx: 1393688576
1 0 0
request GET https://j.ffbbjjkk.com/2701.html
request GET https://j.ffbbjjkk.com/logo.png
Time & API Arguments Status Return Repeated

NtAllocateVirtualMemory

 process_identifier: 1984
region_size: 1507328
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x00450000
allocation_type: 8192 (MEM_RESERVE)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 1984
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x00580000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtProtectVirtualMemory

 process_identifier: 1984
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x73f61000
process_handle: 0xffffffff
1 0 0

NtProtectVirtualMemory

 process_identifier: 1984
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x73f62000
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 1984
region_size: 1507328
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x022e0000
allocation_type: 8192 (MEM_RESERVE)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 1984
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x02410000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 1984
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x00292000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 1984
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x002d5000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 1984
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x002db000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 1984
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x002d7000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 1984
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x002ac000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 1984
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x005d0000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 1984
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x0029a000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0
file C:\Users\test22\AppData\Local\Temp\db.dll
file C:\Users\test22\AppData\Local\Temp\ss31.exe
file C:\Users\test22\AppData\Local\Temp\lgz.exe
file C:\Users\test22\AppData\Local\Temp\lgz.exe
file C:\Users\test22\AppData\Local\Temp\ss31.exe
file C:\Users\test22\AppData\Local\Temp\lgz.exe
file C:\Users\test22\AppData\Local\Temp\db.dll
section {u'size_of_data': u'0x0015da00', u'virtual_address': u'0x00002000', u'entropy': 7.197154130864976, u'name': u'.text', u'virtual_size': u'0x0015d884'} entropy 7.19715413086 description A section with a high entropy has been found
entropy 0.998571938593 description Overall entropy of this PE file is high
registry HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\F81F111D0E5AB58D396F7BF525577FD30FDC95AA\Blob
Time & API Arguments Status Return Repeated

IWbemServices_ExecMethod

 inargs.CurrentDirectory: None
inargs.CommandLine: rundll32.exe "C:\Users\test22\AppData\Local\Temp\db.dll",open
inargs.ProcessStartupInformation: None
flags: 0
method: Create
class: Win32_Process
1 0 0
Bkav W32.AIDetectNet.01
Elastic malicious (high confidence)
MicroWorld-eScan IL:Trojan.MSILZilla.9891
FireEye Generic.mg.97201c944dcd7e82
CAT-QuickHeal Backdoor.MsilFC.S22017452
ALYac IL:Trojan.MSILZilla.9891
Cylance unsafe
Sangfor Trojan.Win32.Save.a
Alibaba TrojanDownloader:MSIL/Mokes.f2b63db1
CrowdStrike win/malicious_confidence_100% (W)
BitDefenderTheta Gen:NN.ZemsilF.36308.xn0@a42Owwn
ESET-NOD32 a variant of MSIL/Agent.UZA
APEX Malicious
Paloalto generic.ml
Kaspersky HEUR:Trojan-Downloader.MSIL.ShortLoader.gen
BitDefender IL:Trojan.MSILZilla.9891
DrWeb Trojan.MulDropNET.43
VIPRE IL:Trojan.MSILZilla.9891
TrendMicro TROJ_GEN.R002C0DCA23
Trapmine malicious.moderate.ml.score
Sophos Troj/ILAgent-I
Ikarus Trojan.MSIL.Agent
Webroot W32.Trojan.MSILZilla
Google Detected
Avira HEUR/AGEN.1234969
Gridinsoft Trojan.Win32.Gen.bot
Arcabit IL:Trojan.MSILZilla.D26A3
Cynet Malicious (score: 100)
AhnLab-V3 Malware/Win.Generic.C4478643
Acronis suspicious
VBA32 Trojan.MSIL.Injector.gen
MAX malware (ai score=88)
Malwarebytes Trojan.Crypt.MSIL.Generic
TrendMicro-HouseCall TROJ_GEN.R002C0DCA23
Tencent Msil.Trojan-Downloader.Shortloader.Bdhl
SentinelOne Static AI - Malicious PE
MaxSecure Trojan.Malware.300983.susgen
Fortinet MSIL/GenKryptik.FFMZ!tr
Panda Trj/GdSda.A