popup
Summary | ZeroBOX
  1. Home
  2. Result
  3. Report
  4. Detail Analysis

llaa25.exe

Gen1 Generic Malware Malicious Packer PE64 PE File
  1. Resubmit sample
Category Machine Started Completed
FILE s1_win7_x6403_us May 18, 2023, 9:33 a.m. May 18, 2023, 9:47 a.m.
Size 291.5KB
Type PE32+ executable (GUI) x86-64, for MS Windows
MD5 aec63ca0e90ee3b2f811656ae8747e9e
SHA256 94e03a7ceab6adddb4e2c0ebc59705a9c6bed46472c4afb9a42bcf439e727aae
CRC32 233B3EBC
ssdeep 6144:C8pJxhKjBkhD5qslNvdA6NZ+cP0MMUcMUDyu5Wp2i3UdSGZRW:1pJxrDNlp1PemUd
PDB Path msconfig.pdb
Yara
  • Win32_Trojan_Gen_2_0904B0_Zero - Win32 Trojan Gen
  • Win32_Trojan_Gen_1_0904B0_Zero - Win32 Trojan Emotet
  • IsPE64 - (no description)
  • PE_Header_Zero - PE File Signature
  • Malicious_Packer_Zero - Malicious Packer
  • Generic_Malware_Zero - Generic Malware

Name Response Post-Analysis Lookup
as.imgjeoigaa.com
A 39.109.117.57
39.109.117.57
us.imgjeoigaa.com
A 154.221.19.146
154.221.19.146
adsmanager.facebook.com
CNAME star.c10r.facebook.com
CNAME star.facebook.com
A 157.240.215.16
157.240.215.16
www.facebook.com
A 157.240.215.35
CNAME star-mini.c10r.facebook.com
157.240.215.35
IP Address Status Action
154.221.19.146 Active Moloch
157.240.215.16 Active Moloch
157.240.215.35 Active Moloch
164.124.101.2 Active Moloch
39.109.117.57 Active Moloch

Suricata Alerts

Flow SID Signature Category
TCP 192.168.56.103:49163 -> 157.240.215.16:443 906200054 SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) undefined
TCP 192.168.56.103:49164 -> 157.240.215.35:443 906200054 SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) undefined
TCP 192.168.56.103:49165 -> 39.109.117.57:80 2003626 ET HUNTING Double User-Agent (User-Agent User-Agent) Potentially Bad Traffic

Suricata TLS

Flow Issuer Subject Fingerprint
TLSv1
192.168.56.103:49163
157.240.215.16:443 		C=US, O=DigiCert Inc, OU=www.digicert.com, CN=DigiCert SHA2 High Assurance Server CA C=US, ST=California, L=Menlo Park, O=Meta Platforms, Inc., CN=*.facebook.com 10:7c:33:90:44:c5:98:16:18:1d:8a:8b:52:5a:43:08:5f:fb:46:3a
TLSv1
192.168.56.103:49164
157.240.215.35:443 		C=US, O=DigiCert Inc, OU=www.digicert.com, CN=DigiCert SHA2 High Assurance Server CA C=US, ST=California, L=Menlo Park, O=Meta Platforms, Inc., CN=*.facebook.com 10:7c:33:90:44:c5:98:16:18:1d:8a:8b:52:5a:43:08:5f:fb:46:3a

registry HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\MachineGuid
pdb_path msconfig.pdb
resource name MUI
resource name REGISTRY
Time & API Arguments Status Return Repeated

__exception__

 stacktrace: 
0x2bda684
0x3b8200

exception.instruction_r: 48 8b 01 ff 50 18 48 8b 43 10 40 32 ed 40 38 68
exception.instruction: mov rax, qword ptr [rcx]
exception.exception_code: 0xc0000005
exception.symbol:
exception.address: 0x2bda684
registers.r14: 46949468
registers.r15: 0
registers.rcx: 0
registers.rsi: 0
registers.r10: 45940736
registers.rbx: 3899904
registers.rsp: 783152
registers.r11: -9151031864016699136
registers.r8: 2
registers.r9: 46634552
registers.rdx: 784264
registers.r12: 0
registers.rbp: 783360
registers.rdi: 784264
registers.rax: 784264
registers.r13: 1
1 0 0
request GET http://us.imgjeoigaa.com/sts/imagc.jpg
request GET http://as.imgjeoigaa.com/check/safe
request GET https://adsmanager.facebook.com/ads/manager/account_settings/account_billing/
request GET https://www.facebook.com/login.php?next=https%3A%2F%2Fadsmanager.facebook.com%2Fads%2Fmanager%2Faccount_settings%2Faccount_billing%2F
Time & API Arguments Status Return Repeated

NtAllocateVirtualMemory

 process_identifier: 1960
region_size: 1499136
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x0000000002a60000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffffffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 1960
region_size: 1241088
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x0000000002bd0000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffffffffffff
1 0 0
file C:\Users\test22\AppData\Local\Google\Chrome\User Data\Profile 58\Network\Cookies
file C:\Users\test22\AppData\Local\Google\Chrome\User Data\Profile 38\Network\Cookies
file C:\Users\test22\AppData\Local\Google\Chrome\User Data\Profile 72\Network\Cookies
file C:\Users\test22\AppData\Local\Google\Chrome\User Data\Profile 81\Network\Cookies
file C:\Users\test22\AppData\Local\Google\Chrome\User Data\Profile 47\Network\Cookies
file C:\Users\test22\AppData\Local\Google\Chrome\User Data\Profile 41\Network\Cookies
file C:\Users\test22\AppData\Local\Google\Chrome\User Data\Profile 56\Network\Cookies
file C:\Users\test22\AppData\Local\Google\Chrome\User Data\Profile 32\Network\Cookies
file C:\Users\test22\AppData\Local\Google\Chrome\User Data\Profile 19\Network\Cookies
file C:\Users\test22\AppData\Local\Google\Chrome\User Data\Profile 30\Network\Cookies
file C:\Users\test22\AppData\Local\Google\Chrome\User Data\Profile 22\Network\Cookies
file C:\Users\test22\AppData\Local\Google\Chrome\User Data\Profile 95\Network\Cookies
file C:\Users\test22\AppData\Local\Google\Chrome\User Data\Profile 70\Network\Cookies
file C:\Users\test22\AppData\Local\Google\Chrome\User Data\Profile 28\Network\Cookies
file C:\Users\test22\AppData\Local\Google\Chrome\User Data\Profile 94\Network\Cookies
file C:\Users\test22\AppData\Local\Google\Chrome\User Data\Profile 68\Network\Cookies
file C:\Users\test22\AppData\Local\Google\Chrome\User Data\Profile 90\Network\Cookies
file C:\Users\test22\AppData\Local\Google\Chrome\User Data\Profile 29\Network\Cookies
file C:\Users\test22\AppData\Local\Google\Chrome\User Data\Profile 91\Network\Cookies
file C:\Users\test22\AppData\Local\Google\Chrome\User Data\Profile 10\Network\Cookies
file C:\Users\test22\AppData\Local\Google\Chrome\User Data\Profile 96\Network\Cookies
file C:\Users\test22\AppData\Local\Google\Chrome\User Data\Profile 46\Network\Cookies
file C:\Users\test22\AppData\Local\Google\Chrome\User Data\Profile 89\Network\Cookies
file C:\Users\test22\AppData\Local\Google\Chrome\User Data\Profile 100\Network\Cookies
file C:\Users\test22\AppData\Local\Google\Chrome\User Data\Profile 66\Network\Cookies
file C:\Users\test22\AppData\Local\Google\Chrome\User Data\Profile 98\Network\Cookies
file C:\Users\test22\AppData\Local\Google\Chrome\User Data\Profile 75\Network\Cookies
file C:\Users\test22\AppData\Local\Google\Chrome\User Data\Profile 86\Network\Cookies
file C:\Users\test22\AppData\Local\Google\Chrome\User Data\Profile 87\Network\Cookies
file C:\Users\test22\AppData\Local\Google\Chrome\User Data\Profile 14\Network\Cookies
file C:\Users\test22\AppData\Local\Google\Chrome\User Data\Profile 82\Network\Cookies
file C:\Users\test22\AppData\Local\Google\Chrome\User Data\Profile 43\Network\Cookies
file C:\Users\test22\AppData\Local\Google\Chrome\User Data\Profile 77\Network\Cookies
file C:\Users\test22\AppData\Local\Google\Chrome\User Data\Profile 61\Network\Cookies
file C:\Users\test22\AppData\Local\Google\Chrome\User Data\Profile 2\Network\Cookies
file C:\Users\test22\AppData\Local\Google\Chrome\User Data\Profile 104\Network\Cookies
file C:\Users\test22\AppData\Local\Google\Chrome\User Data\Profile 67\Network\Cookies
file C:\Users\test22\AppData\Local\Google\Chrome\User Data\Profile 7\Network\Cookies
file C:\Users\test22\AppData\Local\Google\Chrome\User Data\Profile 53\Network\Cookies
file C:\Users\test22\AppData\Local\Google\Chrome\User Data\Profile 33\Network\Cookies
file C:\Users\test22\AppData\Local\Google\Chrome\User Data\Profile 102\Network\Cookies
file C:\Users\test22\AppData\Local\Google\Chrome\User Data\Profile 34\Network\Cookies
file C:\Users\test22\AppData\Local\Google\Chrome\User Data\Profile 99\Network\Cookies
file C:\Users\test22\AppData\Local\Google\Chrome\User Data\Profile 16\Network\Cookies
file C:\Users\test22\AppData\Local\Google\Chrome\User Data\Profile 71\Network\Cookies
file C:\Users\test22\AppData\Local\Google\Chrome\User Data\Profile 42\Network\Cookies
file C:\Users\test22\AppData\Local\Google\Chrome\User Data\Profile 54\Network\Cookies
file C:\Users\test22\AppData\Local\Google\Chrome\User Data\Profile 60\Network\Cookies
file C:\Users\test22\AppData\Local\Google\Chrome\User Data\Profile 24\Network\Cookies
file C:\Users\test22\AppData\Local\Google\Chrome\User Data\Profile 48\Network\Cookies
Time & API Arguments Status Return Repeated

GetAdaptersAddresses

 flags: 15
family: 0
111 0
section {u'size_of_data': u'0x00012200', u'virtual_address': u'0x00039000', u'entropy': 7.176005532126419, u'name': u'.rsrc', u'virtual_size': u'0x00013000'} entropy 7.17600553213 description A section with a high entropy has been found
entropy 0.249569707401 description Overall entropy of this PE file is high
FireEye Generic.mg.aec63ca0e90ee3b2
McAfee Artemis!AEC63CA0E90E
Cyren W64/Agent.GEE.gen!Eldorado
APEX Malicious
Paloalto generic.ml
Kaspersky UDS:DangerousObject.Multi.Generic
Avast FileRepMalware [Misc]
Emsisoft Trojan.GenericKD.67096588 (B)
McAfee-GW-Edition BehavesLike.Win64.Dropper.dh
Microsoft Trojan:Win32/Casdet!rfn
ZoneAlarm UDS:DangerousObject.Multi.Generic
Panda Trj/Chgt.AD
Rising Trojan.Fabookie!8.11C3D (CLOUD)
Fortinet W64/Agent.ZX!tr
AVG FileRepMalware [Misc]
DeepInstinct MALICIOUS
registry HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\F81F111D0E5AB58D396F7BF525577FD30FDC95AA\Blob