Summary | ZeroBOX

Category	Machine	Started	Completed
FILE	s1_win7_x6403_us	May 20, 2023, 4:16 p.m.	May 20, 2023, 4:18 p.m.

Size	1.2MB
Type	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
MD5	`b975131f47777670e30248a7713d3275`
SHA256	`94569ac360b87652cb45ad0945983671523f1a6c8c57fdaf54cf9429d8f4ab8a`
CRC32	`AE931DEA`
ssdeep	`24576:Offra4gKTihdT0HEi7M56wH3bL71O0a8Qz6bs/T75BV6ekyXBTpBqK9PaPC:mqxNi7MIwXbhyXwQ5`
Yara	UPX_Zero - UPX packed file OS_Processor_Check_Zero - OS Processor Check Malicious_Library_Zero - Malicious_Library IsDLL - (no description) IsPE64 - (no description) PE_Header_Zero - PE File Signature

rundll32.exe "C:\Windows\System32\rundll32.exe" C:\Users\test22\AppData\Local\Temp\mn.php.dll,JDuCS622tuL6
840
- rundll32.exe "C:\Windows\System32\rundll32.exe" C:\Users\test22\AppData\Local\Temp\mn.php.dll,JDuCS622tuL6
  2468
rundll32.exe "C:\Windows\System32\rundll32.exe" C:\Users\test22\AppData\Local\Temp\mn.php.dll,PcYge9j
2224
- rundll32.exe "C:\Windows\System32\rundll32.exe" C:\Users\test22\AppData\Local\Temp\mn.php.dll,PcYge9j
  2548
rundll32.exe "C:\Windows\System32\rundll32.exe" C:\Users\test22\AppData\Local\Temp\mn.php.dll,eOXScagadNKe
2316
- rundll32.exe "C:\Windows\System32\rundll32.exe" C:\Users\test22\AppData\Local\Temp\mn.php.dll,eOXScagadNKe
  2512
rundll32.exe "C:\Windows\System32\rundll32.exe" C:\Users\test22\AppData\Local\Temp\mn.php.dll,
2408
rundll32.exe "C:\Windows\System32\rundll32.exe" C:\Users\test22\AppData\Local\Temp\mn.php.dll,MkcDIl34k3Si
2132
- rundll32.exe "C:\Windows\System32\rundll32.exe" C:\Users\test22\AppData\Local\Temp\mn.php.dll,MkcDIl34k3Si
  2600

Name	Response	Post-Analysis Lookup
No hosts contacted.

IP Address	Status	Action
2.228.251.38	Active	Moloch
214.43.249.250	Active	Moloch
34.254.140.99	Active	Moloch
57.182.80.190	Active	Moloch
62.4.213.138	Active	Moloch
92.119.178.40	Active	Moloch

Suricata Alerts

No Suricata Alerts

Suricata TLS

No Suricata TLS

Queries for the computername (4 events)

Time & API	Arguments	Status	Return
GetComputerNameW May 20, 2023, 4:16 p.m.	computer_name: TEST22-PC	1	1
GetComputerNameW May 20, 2023, 4:16 p.m.	computer_name: TEST22-PC	1	1
GetComputerNameW May 20, 2023, 4:16 p.m.	computer_name: TEST22-PC	1	1
GetComputerNameW May 20, 2023, 4:16 p.m.	computer_name: TEST22-PC	1	1

Checks if process is being debugged by a debugger (4 events)

Time & API	Arguments	Status	Return	Repeated
IsDebuggerPresent May 20, 2023, 4:16 p.m.			0	0
IsDebuggerPresent May 20, 2023, 4:16 p.m.			0	0
IsDebuggerPresent May 20, 2023, 4:16 p.m.			0	0
IsDebuggerPresent May 20, 2023, 4:16 p.m.			0	0

The executable contains unknown PE section names indicative of a packer (could be a false positive) (1 event)

section

.gfids

One or more processes crashed (2 events)

Time & API	Arguments	Status	Return	Repeated
__exception__ May 20, 2023, 4:16 p.m.	stacktrace: RtlInitAnsiStringEx+0x24 RtlUnicodeToMultiByteN-0x3c ntdll+0x557f4 @ 0x777157f4 GetFileAttributesA+0x12 GetSystemDefaultLangID-0x7e kernelbase+0xadf2 @ 0x7fefdbfadf2 PcYge9j+0xf3 eOXScagadNKe-0x1813d mn+0x8313 @ 0x7fef3cf8313 rundll32+0x2f42 @ 0xffbe2f42 rundll32+0x3b7a @ 0xffbe3b7a BaseThreadInitThunk+0xd CreateThread-0x53 kernel32+0x1652d @ 0x76fd652d RtlUserThreadStart+0x21 strchr-0x3df ntdll+0x2c521 @ 0x776ec521 exception.instruction_r: f2 ae 48 8b 3c 24 48 f7 d1 48 ff c9 48 81 f9 fe exception.symbol: RtlInitAnsiStringEx+0x24 RtlUnicodeToMultiByteN-0x3c ntdll+0x557f4 exception.instruction: scasb al, byte ptr [rdi] exception.module: ntdll.dll exception.exception_code: 0xc0000005 exception.offset: 350196 exception.address: 0x777157f4 registers.r14: 0 registers.r15: 0 registers.rcx: -1 registers.rsi: 0 registers.r10: 0 registers.rbx: 0 registers.rsp: 1376112 registers.r11: 1375200 registers.r8: 1375440 registers.r9: 10 registers.rdx: 4284613175 registers.r12: 0 registers.rbp: 0 registers.rdi: 0 registers.rax: 0 registers.r13: 0	1	0	0
__exception__ May 20, 2023, 4:16 p.m.	stacktrace: MkcDIl34k3Si+0xcf JDuCS622tuL6-0x2711 mn+0x21c0f @ 0x7fef3d11c0f rundll32+0x2f42 @ 0xffbe2f42 rundll32+0x3b7a @ 0xffbe3b7a BaseThreadInitThunk+0xd CreateThread-0x53 kernel32+0x1652d @ 0x76fd652d RtlUserThreadStart+0x21 strchr-0x3df ntdll+0x2c521 @ 0x776ec521 exception.instruction_r: 89 81 c8 00 00 00 8b 44 24 64 35 09 0c 00 00 39 exception.instruction: mov dword ptr [rcx + 0xc8], eax exception.exception_code: 0xc0000005 exception.symbol: MkcDIl34k3Si+0xcf JDuCS622tuL6-0x2711 mn+0x21c0f exception.address: 0x7fef3d11c0f registers.r14: 0 registers.r15: 0 registers.rcx: 8791771393930 registers.rsi: 0 registers.r10: 0 registers.rbx: 0 registers.rsp: 1375760 registers.r11: 1374848 registers.r8: 3588468 registers.r9: 10 registers.rdx: 4290641920 registers.r12: 0 registers.rbp: 0 registers.rdi: 0 registers.rax: 544438 registers.r13: 0	1	0	0

Allocates read-write-execute memory (usually to unpack itself) (9 events)

Time & API	Arguments	Status
NtAllocateVirtualMemory May 20, 2023, 4:16 p.m.	process_identifier: 2512 region_size: 520192 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0000000001cc0000 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory May 20, 2023, 4:16 p.m.	process_identifier: 2512 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0000000077711000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory May 20, 2023, 4:16 p.m.	process_identifier: 2512 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0000000077711000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory May 20, 2023, 4:16 p.m.	process_identifier: 2512 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0000000077711000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory May 20, 2023, 4:16 p.m.	process_identifier: 2512 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0000000077711000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory May 20, 2023, 4:16 p.m.	process_identifier: 2512 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0000000077711000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory May 20, 2023, 4:16 p.m.	process_identifier: 2512 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0000000077711000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory May 20, 2023, 4:16 p.m.	process_identifier: 2512 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0000000077711000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory May 20, 2023, 4:16 p.m.	process_identifier: 2512 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0000000077711000 process_handle: 0xffffffffffffffff	1

The binary likely contains encrypted or compressed data indicative of a packer (3 events)

section

{u'size_of_data': u'0x0005ee00', u'virtual_address': u'0x00025000', u'entropy': 7.310407790800686, u'name': u'.rdata', u'virtual_size': u'0x0005ec04'}

entropy

7.3104077908

description

A section with a high entropy has been found

section

{u'size_of_data': u'0x000a5200', u'virtual_address': u'0x00084000', u'entropy': 6.917164037571964, u'name': u'.data', u'virtual_size': u'0x000a6428'}

entropy

6.91716403757

description

A section with a high entropy has been found

entropy

0.871386677838

description

Overall entropy of this PE file is high

Communicates with host for which no DNS query was performed (6 events)

host	2.228.251.38
host	214.43.249.250
host	34.254.140.99
host	57.182.80.190
host	62.4.213.138
host	92.119.178.40

Connects to IP addresses that are no longer responding to requests (legitimate services will remain up-and-running usually) (5 events)

dead_host	34.254.140.99:338
dead_host	214.43.249.250:195
dead_host	57.182.80.190:461
dead_host	2.228.251.38:346
dead_host	62.4.213.138:134

mn.php

Process Tree Toggle all

Network Toggle all

Suricata Toggle all

Suricata Alerts

Suricata TLS

Signatures Toggle All