Summary | ZeroBOX

Category	Machine	Started	Completed
FILE	s1_win7_x6401	May 17, 2023, 9 a.m.	May 17, 2023, 9:17 a.m.

Size	89.0KB
Type	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
MD5	`fb32ce419c5bea931a9e3c4ad70dec00`
SHA256	`6e77875e1ef76b39cfc68d919b4919da77d320bf208d826b643bd7ba48a5b38c`
CRC32	`E38B4C88`
ssdeep	`1536:ao4NPCKLbqoYkbpplW9YoUsxXzbcouNhj2ZszsWuKcdJUe0aB89p:aoUCWbBNpplToUs1uNhj25LJULaB89p`
PDB Path	D:\Mktmp\Amadey\ClipperDLL\Release\CLIPPERDLL.pdb
Yara	UPX_Zero - UPX packed file OS_Processor_Check_Zero - OS Processor Check Malicious_Library_Zero - Malicious_Library IsDLL - (no description) PE_Header_Zero - PE File Signature IsPE32 - (no description) Admin_Tool_IN_Zero - Admin Tool Sysinternals

rundll32.exe "C:\Windows\System32\rundll32.exe" C:\Users\test22\AppData\Local\Temp\clip64.dll,??4CClipperDLL@@QAEAAV0@$$QAV0@@Z
2672
rundll32.exe "C:\Windows\System32\rundll32.exe" C:\Users\test22\AppData\Local\Temp\clip64.dll,??4CClipperDLL@@QAEAAV0@ABV0@@Z
2756
rundll32.exe "C:\Windows\System32\rundll32.exe" C:\Users\test22\AppData\Local\Temp\clip64.dll,Main
2852
rundll32.exe "C:\Windows\System32\rundll32.exe" C:\Users\test22\AppData\Local\Temp\clip64.dll,
2952

Name	Response	Post-Analysis Lookup
No hosts contacted.

IP Address	Status	Action
117.18.232.200	Active	Moloch
164.124.101.2	Active	Moloch

Suricata Alerts

No Suricata Alerts

Suricata TLS

No Suricata TLS

Checks if process is being debugged by a debugger (3 events)

Time & API	Arguments	Status	Return	Repeated
IsDebuggerPresent May 17, 2023, 9 a.m.			0	0
IsDebuggerPresent May 17, 2023, 9 a.m.			0	0
IsDebuggerPresent May 17, 2023, 9 a.m.			0	0

This executable has a PDB path (1 event)

pdb_path

D:\Mktmp\Amadey\ClipperDLL\Release\CLIPPERDLL.pdb

Allocates read-write-execute memory (usually to unpack itself) (21 events)

Time & API	Arguments	Status
NtProtectVirtualMemory May 17, 2023, 9 a.m.	process_identifier: 2672 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x73bff000 process_handle: 0xffffffff	1
NtProtectVirtualMemory May 17, 2023, 9 a.m.	process_identifier: 2672 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x73660000 process_handle: 0xffffffff	1
NtProtectVirtualMemory May 17, 2023, 9 a.m.	process_identifier: 2672 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x735e1000 process_handle: 0xffffffff	1
NtProtectVirtualMemory May 17, 2023, 9 a.m.	process_identifier: 2672 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x73551000 process_handle: 0xffffffff	1
NtProtectVirtualMemory May 17, 2023, 9 a.m.	process_identifier: 2672 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x73514000 process_handle: 0xffffffff	1
NtProtectVirtualMemory May 17, 2023, 9 a.m.	process_identifier: 2672 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x735e2000 process_handle: 0xffffffff	1
NtProtectVirtualMemory May 17, 2023, 9 a.m.	process_identifier: 2672 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x73c11000 process_handle: 0xffffffff	1
NtProtectVirtualMemory May 17, 2023, 9 a.m.	process_identifier: 2756 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x73bff000 process_handle: 0xffffffff	1
NtProtectVirtualMemory May 17, 2023, 9 a.m.	process_identifier: 2756 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x73660000 process_handle: 0xffffffff	1
NtProtectVirtualMemory May 17, 2023, 9 a.m.	process_identifier: 2756 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x735e1000 process_handle: 0xffffffff	1
NtProtectVirtualMemory May 17, 2023, 9 a.m.	process_identifier: 2756 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x73551000 process_handle: 0xffffffff	1
NtProtectVirtualMemory May 17, 2023, 9 a.m.	process_identifier: 2756 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x73514000 process_handle: 0xffffffff	1
NtProtectVirtualMemory May 17, 2023, 9 a.m.	process_identifier: 2756 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x735e2000 process_handle: 0xffffffff	1
NtProtectVirtualMemory May 17, 2023, 9 a.m.	process_identifier: 2756 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x73c11000 process_handle: 0xffffffff	1
NtProtectVirtualMemory May 17, 2023, 9 a.m.	process_identifier: 2852 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x73bff000 process_handle: 0xffffffff	1
NtProtectVirtualMemory May 17, 2023, 9 a.m.	process_identifier: 2852 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x73660000 process_handle: 0xffffffff	1
NtProtectVirtualMemory May 17, 2023, 9 a.m.	process_identifier: 2852 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x735e1000 process_handle: 0xffffffff	1
NtProtectVirtualMemory May 17, 2023, 9 a.m.	process_identifier: 2852 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x734c1000 process_handle: 0xffffffff	1
NtProtectVirtualMemory May 17, 2023, 9 a.m.	process_identifier: 2852 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x73484000 process_handle: 0xffffffff	1
NtProtectVirtualMemory May 17, 2023, 9 a.m.	process_identifier: 2852 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x735e2000 process_handle: 0xffffffff	1
NtProtectVirtualMemory May 17, 2023, 9 a.m.	process_identifier: 2852 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x73bd1000 process_handle: 0xffffffff	1

Communicates with host for which no DNS query was performed (1 event)

host

117.18.232.200

Connects to an IP address that is no longer responding to requests (legitimate services will remain up-and-running usually) (1 event)

dead_host

192.168.56.101:49175

File has been identified by 54 AntiVirus engines on VirusTotal as malicious (50 out of 54 events)

Bkav	W32.NataDecoAAT.Trojan
Elastic	malicious (high confidence)
DrWeb	Trojan.Clipper.165
MicroWorld-eScan	Gen:Variant.Zusy.446682
FireEye	Gen:Variant.Zusy.446682
CAT-QuickHeal	Trojan.GenericPMF.S29595454
ALYac	Gen:Variant.Zusy.446682
Malwarebytes	Trojan.Amadey
Zillya	Trojan.Sdum.Win32.9736
Sangfor	Trojan.Win32.Amadey.Vpws
K7AntiVirus	Riskware ( 00584baa1 )
Alibaba	TrojanDownloader:Win32/Amadey.008acf45
K7GW	Riskware ( 00584baa1 )
CrowdStrike	win/malicious_confidence_100% (W)
Arcabit	Trojan.Zusy.D6D0DA
BitDefenderTheta	Gen:NN.ZedlaF.36196.fu4@aaxg1koi
VirIT	Trojan.Win32.Genus.NMA
Cyren	W32/Agent.GPBN-4848
Symantec	ML.Attribute.HighConfidence
ESET-NOD32	a variant of Win32/TrojanDownloader.Amadey.H
Cynet	Malicious (score: 99)
APEX	Malicious
ClamAV	Win.Malware.Zusy-10001339-0
Kaspersky	HEUR:Trojan.Win32.Agent.gen
BitDefender	Gen:Variant.Zusy.446682
NANO-Antivirus	Trojan.Win32.Clipper.juivsg
SUPERAntiSpyware	Trojan.Agent/Gen-Kryptik
Avast	Win32:BotX-gen [Trj]
Tencent	Malware.Win32.Gencirc.10bdd5b2
Emsisoft	Gen:Variant.Zusy.446682 (B)
F-Secure	Heuristic.HEUR/AGEN.1301048
VIPRE	Gen:Variant.Zusy.446682
McAfee-GW-Edition	Trojan-FUUW!FB32CE419C5B
Sophos	Troj/Amadey-K
Jiangmin	Trojan.Agent.ejvu
Avira	HEUR/AGEN.1301048
MAX	malware (ai score=88)
Antiy-AVL	Trojan/Win32.Wacatac
Microsoft	Trojan:Win32/Amadey!ic
ZoneAlarm	HEUR:Trojan.Win32.Agent.gen
GData	Gen:Variant.Zusy.446682
Google	Detected
AhnLab-V3	Trojan/Win.Generic.C5355012
McAfee	Artemis!FB32CE419C5B
TACHYON	Trojan/W32.Agent.91136.ADU
VBA32	Trojan.Sabsik
Cylance	unsafe
Panda	Trj/GdSda.A
Rising	Trojan.Generic@AI.100 (RDML:UOvjVOFWo3+5kBV55m4AZg)
Yandex	Trojan.Agent!Z+iHCi/9aN0

clip64.dll

Process Tree Toggle all

Network Toggle all

Suricata Toggle all

Suricata Alerts

Suricata TLS

Signatures Toggle All