Summary | ZeroBOX

Category	Machine	Started	Completed
FILE	s1_win7_x6403_us	May 20, 2023, 4:18 p.m.	May 20, 2023, 4:20 p.m.

Size	1.2MB
Type	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
MD5	`8444b7011547a0b4bdc18437aa9d6e83`
SHA256	`5fe729f544cc86f4f5ccf5dae66af895a29bcae90e081589b318c3d62ab5b56a`
CRC32	`51493D91`
ssdeep	`24576:+f1mNgvhcTL+puoCTrQwYKUkzGE0MbyvDPZGz7VlWnJ0iKS0tMNiG:dQS+WvVUxle5G`
Yara	UPX_Zero - UPX packed file OS_Processor_Check_Zero - OS Processor Check Malicious_Library_Zero - Malicious_Library IsDLL - (no description) IsPE64 - (no description) PE_Header_Zero - PE File Signature

rundll32.exe "C:\Windows\System32\rundll32.exe" C:\Users\test22\AppData\Local\Temp\mn.php.dll,JDuCS622tuL6
1372
- rundll32.exe "C:\Windows\System32\rundll32.exe" C:\Users\test22\AppData\Local\Temp\mn.php.dll,JDuCS622tuL6
  2344
rundll32.exe "C:\Windows\System32\rundll32.exe" C:\Users\test22\AppData\Local\Temp\mn.php.dll,MkcDIl34k3Si
2096
- rundll32.exe "C:\Windows\System32\rundll32.exe" C:\Users\test22\AppData\Local\Temp\mn.php.dll,MkcDIl34k3Si
  2384
rundll32.exe "C:\Windows\System32\rundll32.exe" C:\Users\test22\AppData\Local\Temp\mn.php.dll,PcYge9j
2200
- rundll32.exe "C:\Windows\System32\rundll32.exe" C:\Users\test22\AppData\Local\Temp\mn.php.dll,PcYge9j
  2500
rundll32.exe "C:\Windows\System32\rundll32.exe" C:\Users\test22\AppData\Local\Temp\mn.php.dll,eOXScagadNKe
2296
- rundll32.exe "C:\Windows\System32\rundll32.exe" C:\Users\test22\AppData\Local\Temp\mn.php.dll,eOXScagadNKe
  2592
rundll32.exe "C:\Windows\System32\rundll32.exe" C:\Users\test22\AppData\Local\Temp\mn.php.dll,
2468

Name	Response	Post-Analysis Lookup
No hosts contacted.

IP Address	Status	Action
164.124.101.2	Active	Moloch
2.228.251.38	Active	Moloch
214.43.249.250	Active	Moloch
34.254.140.99	Active	Moloch
57.182.80.190	Active	Moloch
62.4.213.138	Active	Moloch
92.119.178.40	Active	Moloch

Suricata Alerts

No Suricata Alerts

Suricata TLS

No Suricata TLS

Queries for the computername (4 events)

Time & API	Arguments	Status	Return
GetComputerNameW May 20, 2023, 4:18 p.m.	computer_name: TEST22-PC	1	1
GetComputerNameW May 20, 2023, 4:18 p.m.	computer_name: TEST22-PC	1	1
GetComputerNameW May 20, 2023, 4:18 p.m.	computer_name: TEST22-PC	1	1
GetComputerNameW May 20, 2023, 4:18 p.m.	computer_name: TEST22-PC	1	1

Checks if process is being debugged by a debugger (4 events)

Time & API	Arguments	Status	Return	Repeated
IsDebuggerPresent May 20, 2023, 4:18 p.m.			0	0
IsDebuggerPresent May 20, 2023, 4:18 p.m.			0	0
IsDebuggerPresent May 20, 2023, 4:18 p.m.			0	0
IsDebuggerPresent May 20, 2023, 4:18 p.m.			0	0

The executable contains unknown PE section names indicative of a packer (could be a false positive) (1 event)

section

.gfids

One or more processes crashed (1 event)

Time & API	Arguments	Status	Return	Repeated
__exception__ May 20, 2023, 4:18 p.m.	stacktrace: MkcDIl34k3Si+0xcf JDuCS622tuL6-0x2751 mn+0x21c8f @ 0x7fef3c91c8f rundll32+0x2f42 @ 0xff802f42 rundll32+0x3b7a @ 0xff803b7a BaseThreadInitThunk+0xd CreateThread-0x53 kernel32+0x1652d @ 0x76fd652d RtlUserThreadStart+0x21 strchr-0x3df ntdll+0x2c521 @ 0x776ec521 exception.instruction_r: 89 81 c8 00 00 00 8b 44 24 64 35 d3 26 00 00 39 exception.instruction: mov dword ptr [rcx + 0xc8], eax exception.exception_code: 0xc0000005 exception.symbol: MkcDIl34k3Si+0xcf JDuCS622tuL6-0x2751 mn+0x21c8f exception.address: 0x7fef3c91c8f registers.r14: 0 registers.r15: 0 registers.rcx: 8791771393930 registers.rsi: 0 registers.r10: 0 registers.rbx: 0 registers.rsp: 1243424 registers.r11: 1242512 registers.r8: 2605428 registers.r9: 10 registers.rdx: 4286578688 registers.r12: 0 registers.rbp: 0 registers.rdi: 0 registers.rax: 544438 registers.r13: 0	1	0	0

Allocates read-write-execute memory (usually to unpack itself) (9 events)

Time & API	Arguments	Status
NtAllocateVirtualMemory May 20, 2023, 4:18 p.m.	process_identifier: 2592 region_size: 520192 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0000000001de0000 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory May 20, 2023, 4:18 p.m.	process_identifier: 2592 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0000000077711000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory May 20, 2023, 4:18 p.m.	process_identifier: 2592 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0000000077711000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory May 20, 2023, 4:18 p.m.	process_identifier: 2592 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0000000077711000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory May 20, 2023, 4:18 p.m.	process_identifier: 2592 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0000000077711000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory May 20, 2023, 4:18 p.m.	process_identifier: 2592 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0000000077711000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory May 20, 2023, 4:18 p.m.	process_identifier: 2592 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0000000077711000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory May 20, 2023, 4:18 p.m.	process_identifier: 2592 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0000000077711000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory May 20, 2023, 4:18 p.m.	process_identifier: 2592 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0000000077711000 process_handle: 0xffffffffffffffff	1

The binary likely contains encrypted or compressed data indicative of a packer (3 events)

section

{u'size_of_data': u'0x0005de00', u'virtual_address': u'0x00025000', u'entropy': 7.304966325567673, u'name': u'.rdata', u'virtual_size': u'0x0005dc94'}

entropy

7.30496632557

description

A section with a high entropy has been found

section

{u'size_of_data': u'0x000a6e00', u'virtual_address': u'0x00083000', u'entropy': 6.916381721497334, u'name': u'.data', u'virtual_size': u'0x000a8008'}

entropy

6.9163817215

description

A section with a high entropy has been found

entropy

0.871709151692

description

Overall entropy of this PE file is high

Communicates with host for which no DNS query was performed (6 events)

host	2.228.251.38
host	214.43.249.250
host	34.254.140.99
host	57.182.80.190
host	62.4.213.138
host	92.119.178.40

Connects to IP addresses that are no longer responding to requests (legitimate services will remain up-and-running usually) (5 events)

dead_host	34.254.140.99:338
dead_host	214.43.249.250:195
dead_host	57.182.80.190:461
dead_host	2.228.251.38:346
dead_host	62.4.213.138:134

mn.php

Process Tree Toggle all

Network Toggle all

Suricata Toggle all

Suricata Alerts

Suricata TLS

Signatures Toggle All