popup
Summary | ZeroBOX
  1. Home
  2. Result
  3. Report
  4. Detail Analysis

lish.exe

Emotet UPX Malicious Library Malicious Packer PE File DLL OS Processor Check PE32
  1. Resubmit sample
Category Machine Started Completed
FILE s1_win7_x6401 March 17, 2023, 9:39 a.m. March 17, 2023, 9:51 a.m.
Size 328.0KB
Type PE32 executable (GUI) Intel 80386, for MS Windows
MD5 0b39012e51e6d52ddc49dd9676ba9920
SHA256 6aea187ca91ea68222b4e650e2b4baa46ba11252f74763a2d2edec2924a98f10
CRC32 81E5DEB3
ssdeep 6144:evSBanJK/5kPas8N0HEAAf1vbViarAWbd33uEPT:evjas8uHEAAtvBpkLEPT
Yara
  • UPX_Zero - UPX packed file
  • Malicious_Library_Zero - Malicious_Library
  • OS_Processor_Check_Zero - OS Processor Check
  • Malicious_Packer_Zero - Malicious Packer
  • IsPE32 - (no description)
  • PE_Header_Zero - PE File Signature
  • Win32_Trojan_Emotet_1_Zero - Win32 Trojan Emotet

Name Response Post-Analysis Lookup
j.ffbbjjkk.com
A 104.21.8.227
A 172.67.158.22
172.67.158.22
IP Address Status Action
104.21.8.227 Active Moloch
164.124.101.2 Active Moloch

Suricata Alerts

Flow SID Signature Category
TCP 192.168.56.101:49162 -> 104.21.8.227:443 906200054 SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) undefined

Suricata TLS

Flow Issuer Subject Fingerprint
TLSv1
192.168.56.101:49162
104.21.8.227:443 		C=US, O=Google Trust Services LLC, CN=GTS CA 1P5 CN=*.ffbbjjkk.com 8a:a5:6d:82:a6:a0:20:43:b2:b0:7e:aa:9a:9f:c2:ad:00:dd:fe:84

Time & API Arguments Status Return Repeated

GetComputerNameW

 computer_name: TEST22-PC
1 1 0
Time & API Arguments Status Return Repeated

GlobalMemoryStatusEx

 1 1 0
resource name TYPELIB
Time & API Arguments Status Return Repeated

__exception__

 stacktrace: 
lish+0x23ee @ 0x4023ee

exception.instruction_r: 8b 00 8b 00 8b 40 10 8b 55 20 8b 12 c7 44 24 14
exception.symbol: New___wmi___IWbemServices_ExecMethod@32+0x2a3 New___wmi___IWbemServices_ExecMethodAsync@28-0xde
exception.instruction: mov eax, dword ptr [eax]
exception.module: monitor-x86.dll
exception.exception_code: 0xc0000005
exception.offset: 66639
exception.address: 0x7354044f
registers.esp: 1634368
registers.edi: 6378780
registers.eax: 0
registers.ebp: 1634824
registers.edx: 1634060
registers.ebx: 0
registers.esi: 1634916
registers.ecx: 2130509824
1 0 0
request GET https://j.ffbbjjkk.com/35.html
request GET https://j.ffbbjjkk.com/logo.png
Time & API Arguments Status Return Repeated

NtProtectVirtualMemory

 process_identifier: 2552
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x734c2000
process_handle: 0xffffffff
1 0 0

NtProtectVirtualMemory

 process_identifier: 2656
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x734c2000
process_handle: 0xffffffff
1 0 0
name TYPELIB language LANG_CHINESE filetype data sublanguage SUBLANG_CHINESE_SIMPLIFIED offset 0x0004cd10 size 0x0000062c
name RT_CURSOR language LANG_CHINESE filetype data sublanguage SUBLANG_CHINESE_SIMPLIFIED offset 0x0004e4c8 size 0x00000134
name RT_CURSOR language LANG_CHINESE filetype data sublanguage SUBLANG_CHINESE_SIMPLIFIED offset 0x0004e4c8 size 0x00000134
name RT_CURSOR language LANG_CHINESE filetype data sublanguage SUBLANG_CHINESE_SIMPLIFIED offset 0x0004e4c8 size 0x00000134
name RT_CURSOR language LANG_CHINESE filetype data sublanguage SUBLANG_CHINESE_SIMPLIFIED offset 0x0004e4c8 size 0x00000134
name RT_CURSOR language LANG_CHINESE filetype data sublanguage SUBLANG_CHINESE_SIMPLIFIED offset 0x0004e4c8 size 0x00000134
name RT_CURSOR language LANG_CHINESE filetype data sublanguage SUBLANG_CHINESE_SIMPLIFIED offset 0x0004e4c8 size 0x00000134
name RT_CURSOR language LANG_CHINESE filetype data sublanguage SUBLANG_CHINESE_SIMPLIFIED offset 0x0004e4c8 size 0x00000134
name RT_CURSOR language LANG_CHINESE filetype data sublanguage SUBLANG_CHINESE_SIMPLIFIED offset 0x0004e4c8 size 0x00000134
name RT_CURSOR language LANG_CHINESE filetype data sublanguage SUBLANG_CHINESE_SIMPLIFIED offset 0x0004e4c8 size 0x00000134
name RT_CURSOR language LANG_CHINESE filetype data sublanguage SUBLANG_CHINESE_SIMPLIFIED offset 0x0004e4c8 size 0x00000134
name RT_CURSOR language LANG_CHINESE filetype data sublanguage SUBLANG_CHINESE_SIMPLIFIED offset 0x0004e4c8 size 0x00000134
name RT_CURSOR language LANG_CHINESE filetype data sublanguage SUBLANG_CHINESE_SIMPLIFIED offset 0x0004e4c8 size 0x00000134
name RT_CURSOR language LANG_CHINESE filetype data sublanguage SUBLANG_CHINESE_SIMPLIFIED offset 0x0004e4c8 size 0x00000134
name RT_CURSOR language LANG_CHINESE filetype data sublanguage SUBLANG_CHINESE_SIMPLIFIED offset 0x0004e4c8 size 0x00000134
name RT_CURSOR language LANG_CHINESE filetype data sublanguage SUBLANG_CHINESE_SIMPLIFIED offset 0x0004e4c8 size 0x00000134
name RT_CURSOR language LANG_CHINESE filetype data sublanguage SUBLANG_CHINESE_SIMPLIFIED offset 0x0004e4c8 size 0x00000134
name RT_BITMAP language LANG_CHINESE filetype data sublanguage SUBLANG_CHINESE_SIMPLIFIED offset 0x0004e6b4 size 0x00000144
name RT_BITMAP language LANG_CHINESE filetype data sublanguage SUBLANG_CHINESE_SIMPLIFIED offset 0x0004e6b4 size 0x00000144
name RT_ICON language LANG_CHINESE filetype GLS_BINARY_LSB_FIRST sublanguage SUBLANG_CHINESE_SIMPLIFIED offset 0x00053878 size 0x00000368
name RT_ICON language LANG_CHINESE filetype GLS_BINARY_LSB_FIRST sublanguage SUBLANG_CHINESE_SIMPLIFIED offset 0x00053878 size 0x00000368
name RT_ICON language LANG_CHINESE filetype GLS_BINARY_LSB_FIRST sublanguage SUBLANG_CHINESE_SIMPLIFIED offset 0x00053878 size 0x00000368
name RT_ICON language LANG_CHINESE filetype GLS_BINARY_LSB_FIRST sublanguage SUBLANG_CHINESE_SIMPLIFIED offset 0x00053878 size 0x00000368
name RT_ICON language LANG_CHINESE filetype GLS_BINARY_LSB_FIRST sublanguage SUBLANG_CHINESE_SIMPLIFIED offset 0x00053878 size 0x00000368
name RT_ICON language LANG_CHINESE filetype GLS_BINARY_LSB_FIRST sublanguage SUBLANG_CHINESE_SIMPLIFIED offset 0x00053878 size 0x00000368
name RT_ICON language LANG_CHINESE filetype GLS_BINARY_LSB_FIRST sublanguage SUBLANG_CHINESE_SIMPLIFIED offset 0x00053878 size 0x00000368
name RT_ICON language LANG_CHINESE filetype GLS_BINARY_LSB_FIRST sublanguage SUBLANG_CHINESE_SIMPLIFIED offset 0x00053878 size 0x00000368
name RT_ICON language LANG_CHINESE filetype GLS_BINARY_LSB_FIRST sublanguage SUBLANG_CHINESE_SIMPLIFIED offset 0x00053878 size 0x00000368
name RT_DIALOG language LANG_CHINESE filetype data sublanguage SUBLANG_CHINESE_SIMPLIFIED offset 0x00053eec size 0x00000034
name RT_DIALOG language LANG_CHINESE filetype data sublanguage SUBLANG_CHINESE_SIMPLIFIED offset 0x00053eec size 0x00000034
name RT_DIALOG language LANG_CHINESE filetype data sublanguage SUBLANG_CHINESE_SIMPLIFIED offset 0x00053eec size 0x00000034
name RT_DIALOG language LANG_CHINESE filetype data sublanguage SUBLANG_CHINESE_SIMPLIFIED offset 0x00053eec size 0x00000034
name RT_STRING language LANG_CHINESE filetype data sublanguage SUBLANG_CHINESE_SIMPLIFIED offset 0x00055698 size 0x00000042
name RT_STRING language LANG_CHINESE filetype data sublanguage SUBLANG_CHINESE_SIMPLIFIED offset 0x00055698 size 0x00000042
name RT_STRING language LANG_CHINESE filetype data sublanguage SUBLANG_CHINESE_SIMPLIFIED offset 0x00055698 size 0x00000042
name RT_STRING language LANG_CHINESE filetype data sublanguage SUBLANG_CHINESE_SIMPLIFIED offset 0x00055698 size 0x00000042
name RT_STRING language LANG_CHINESE filetype data sublanguage SUBLANG_CHINESE_SIMPLIFIED offset 0x00055698 size 0x00000042
name RT_STRING language LANG_CHINESE filetype data sublanguage SUBLANG_CHINESE_SIMPLIFIED offset 0x00055698 size 0x00000042
name RT_STRING language LANG_CHINESE filetype data sublanguage SUBLANG_CHINESE_SIMPLIFIED offset 0x00055698 size 0x00000042
name RT_STRING language LANG_CHINESE filetype data sublanguage SUBLANG_CHINESE_SIMPLIFIED offset 0x00055698 size 0x00000042
name RT_STRING language LANG_CHINESE filetype data sublanguage SUBLANG_CHINESE_SIMPLIFIED offset 0x00055698 size 0x00000042
name RT_STRING language LANG_CHINESE filetype data sublanguage SUBLANG_CHINESE_SIMPLIFIED offset 0x00055698 size 0x00000042
name RT_STRING language LANG_CHINESE filetype data sublanguage SUBLANG_CHINESE_SIMPLIFIED offset 0x00055698 size 0x00000042
name RT_STRING language LANG_CHINESE filetype data sublanguage SUBLANG_CHINESE_SIMPLIFIED offset 0x00055698 size 0x00000042
name RT_STRING language LANG_CHINESE filetype data sublanguage SUBLANG_CHINESE_SIMPLIFIED offset 0x00055698 size 0x00000042
name RT_STRING language LANG_CHINESE filetype data sublanguage SUBLANG_CHINESE_SIMPLIFIED offset 0x00055698 size 0x00000042
name RT_GROUP_CURSOR language LANG_CHINESE filetype Lotus unknown worksheet or configuration, revision 0x1 sublanguage SUBLANG_CHINESE_SIMPLIFIED offset 0x00055804 size 0x00000014
name RT_GROUP_CURSOR language LANG_CHINESE filetype Lotus unknown worksheet or configuration, revision 0x1 sublanguage SUBLANG_CHINESE_SIMPLIFIED offset 0x00055804 size 0x00000014
name RT_GROUP_CURSOR language LANG_CHINESE filetype Lotus unknown worksheet or configuration, revision 0x1 sublanguage SUBLANG_CHINESE_SIMPLIFIED offset 0x00055804 size 0x00000014
name RT_GROUP_CURSOR language LANG_CHINESE filetype Lotus unknown worksheet or configuration, revision 0x1 sublanguage SUBLANG_CHINESE_SIMPLIFIED offset 0x00055804 size 0x00000014
file C:\Users\test22\AppData\Local\Temp\db.dll
file C:\Users\test22\AppData\Local\Temp\db.dll
Time & API Arguments Status Return Repeated

IWbemServices_ExecMethod

 inargs.CurrentDirectory: None
inargs.CommandLine: rundll32.exe "C:\Users\test22\AppData\Local\Temp\db.dll",open
inargs.ProcessStartupInformation: None
flags: 0
method: Create
class: Win32_Process
1 0 0
Lionic Trojan.Win32.Manuscrypt.4!c
Elastic malicious (moderate confidence)
MicroWorld-eScan Trojan.GenericKD.65959374
FireEye Trojan.GenericKD.65959374
McAfee Artemis!0B39012E51E6
Zillya Backdoor.Manuscrypt.Win32.136
Sangfor Backdoor.Win32.Manuscrypt.Vpxc
CrowdStrike win/malicious_confidence_100% (W)
Alibaba Backdoor:Win32/Manuscrypt.9607ccad
K7GW Trojan-Downloader ( 005a0d6e1 )
Arcabit Trojan.GenericFCA.Agent.D1263C
VirIT Trojan.Win32.Genus.OCH
Cyren W32/ABRisk.RWQJ-3106
Symantec Trojan.Gen.2
ESET-NOD32 Win32/TrojanDownloader.Agent.GTM
Cynet Malicious (score: 99)
APEX Malicious
Paloalto generic.ml
Kaspersky HEUR:Backdoor.Win32.Manuscrypt.gen
BitDefender Trojan.GenericKD.65959374
NANO-Antivirus Trojan.Win32.Manuscrypt.jvefad
Avast Win32:Malware-gen
Tencent Malware.Win32.Gencirc.10be3b07
DrWeb Trojan.Packed2.45018
VIPRE Trojan.GenericFCA.Agent.75324
TrendMicro TROJ_GEN.R049C0PCG23
Emsisoft Trojan.GenericKD.65959374 (B)
Ikarus Trojan-Downloader.Win32.Agent
Webroot W32.Trojan.Gen
Avira BDS/Redcap.utckv
MAX malware (ai score=86)
Antiy-AVL Trojan[Backdoor]/Win32.Manuscrypt
Gridinsoft Trojan.Win32.Agent.cl
Microsoft Trojan:Win32/Manuscrypt.RB!MTB
ViRobot Trojan.Win.Z.Agent.335872.T
GData Win32.Trojan.PSE.OQUPP8
Google Detected
AhnLab-V3 Malware/Win.Generic.C5393564
VBA32 Backdoor.Manuscrypt
ALYac Trojan.GenericFCA.Agent.75324
TrendMicro-HouseCall TROJ_GEN.R049C0PCG23
Rising Backdoor.Manuscrypt!8.110D5 (TFE:5:IwRj5swpWAI)
Fortinet W32/Kryptik.2F02!tr
BitDefenderTheta Gen:NN.ZexaF.36344.uq0@aWhC4sfj
AVG Win32:Malware-gen
Panda Trj/Chgt.AD