Summary | ZeroBOX

Category	Machine	Started	Completed
FILE	s1_win7_x6403_us	May 20, 2023, 4:18 p.m.	May 20, 2023, 4:31 p.m.

Size	1.2MB
Type	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
MD5	`8fc84574c4e42940483c171e278c9338`
SHA256	`9533a4c05534ca8c07e51b828c822f3a5f3e0cde8cb1e4edf9f8dac743e777d4`
CRC32	`2838DEFF`
ssdeep	`24576:jtl0RPQ02pA6bHvn6/yzI+bdIP7P6d4SitpwqrK1AmIfGH0qh/OM/l:UGpS6RQSi56lthn`
Yara	UPX_Zero - UPX packed file OS_Processor_Check_Zero - OS Processor Check Malicious_Library_Zero - Malicious_Library IsDLL - (no description) IsPE64 - (no description) PE_Header_Zero - PE File Signature

rundll32.exe "C:\Windows\System32\rundll32.exe" C:\Users\test22\AppData\Local\Temp\mn.php.dll,JDuCS622tuL6
2056
- rundll32.exe "C:\Windows\System32\rundll32.exe" C:\Users\test22\AppData\Local\Temp\mn.php.dll,JDuCS622tuL6
  2492
rundll32.exe "C:\Windows\System32\rundll32.exe" C:\Users\test22\AppData\Local\Temp\mn.php.dll,PcYge9j
2248
- rundll32.exe "C:\Windows\System32\rundll32.exe" C:\Users\test22\AppData\Local\Temp\mn.php.dll,PcYge9j
  2520
rundll32.exe "C:\Windows\System32\rundll32.exe" C:\Users\test22\AppData\Local\Temp\mn.php.dll,MkcDIl34k3Si
2160
- rundll32.exe "C:\Windows\System32\rundll32.exe" C:\Users\test22\AppData\Local\Temp\mn.php.dll,MkcDIl34k3Si
  2572
rundll32.exe "C:\Windows\System32\rundll32.exe" C:\Users\test22\AppData\Local\Temp\mn.php.dll,eOXScagadNKe
2340
- rundll32.exe "C:\Windows\System32\rundll32.exe" C:\Users\test22\AppData\Local\Temp\mn.php.dll,eOXScagadNKe
  2620
rundll32.exe "C:\Windows\System32\rundll32.exe" C:\Users\test22\AppData\Local\Temp\mn.php.dll,
2440

Name	Response	Post-Analysis Lookup
No hosts contacted.

IP Address	Status	Action
2.228.251.38	Active	Moloch
214.43.249.250	Active	Moloch
34.254.140.99	Active	Moloch
57.182.80.190	Active	Moloch
62.4.213.138	Active	Moloch
92.119.178.40	Active	Moloch

Suricata Alerts

No Suricata Alerts

Suricata TLS

No Suricata TLS

Queries for the computername (4 events)

Time & API	Arguments	Status	Return
GetComputerNameW May 20, 2023, 4:18 p.m.	computer_name: TEST22-PC	1	1
GetComputerNameW May 20, 2023, 4:18 p.m.	computer_name: TEST22-PC	1	1
GetComputerNameW May 20, 2023, 4:18 p.m.	computer_name: TEST22-PC	1	1
GetComputerNameW May 20, 2023, 4:18 p.m.	computer_name: TEST22-PC	1	1

Checks if process is being debugged by a debugger (4 events)

Time & API	Arguments	Status	Return	Repeated
IsDebuggerPresent May 20, 2023, 4:18 p.m.			0	0
IsDebuggerPresent May 20, 2023, 4:18 p.m.			0	0
IsDebuggerPresent May 20, 2023, 4:18 p.m.			0	0
IsDebuggerPresent May 20, 2023, 4:18 p.m.			0	0

The executable contains unknown PE section names indicative of a packer (could be a false positive) (1 event)

section

.gfids

One or more processes crashed (2 events)

Time & API	Arguments	Status	Return	Repeated
__exception__ May 20, 2023, 4:18 p.m.	stacktrace: RtlInitAnsiStringEx+0x24 RtlUnicodeToMultiByteN-0x3c ntdll+0x557f4 @ 0x777157f4 GetFileAttributesA+0x12 GetSystemDefaultLangID-0x7e kernelbase+0xadf2 @ 0x7fefdbfadf2 PcYge9j+0xf3 eOXScagadNKe-0x1813d mn+0x8353 @ 0x7fef3cf8353 rundll32+0x2f42 @ 0xff302f42 rundll32+0x3b7a @ 0xff303b7a BaseThreadInitThunk+0xd CreateThread-0x53 kernel32+0x1652d @ 0x76fd652d RtlUserThreadStart+0x21 strchr-0x3df ntdll+0x2c521 @ 0x776ec521 exception.instruction_r: f2 ae 48 8b 3c 24 48 f7 d1 48 ff c9 48 81 f9 fe exception.symbol: RtlInitAnsiStringEx+0x24 RtlUnicodeToMultiByteN-0x3c ntdll+0x557f4 exception.instruction: scasb al, byte ptr [rdi] exception.module: ntdll.dll exception.exception_code: 0xc0000005 exception.offset: 350196 exception.address: 0x777157f4 registers.r14: 0 registers.r15: 0 registers.rcx: -1 registers.rsi: 0 registers.r10: 0 registers.rbx: 0 registers.rsp: 2095984 registers.r11: 2095072 registers.r8: 2095312 registers.r9: 10 registers.rdx: 4275297543 registers.r12: 0 registers.rbp: 0 registers.rdi: 0 registers.rax: 0 registers.r13: 0	1	0	0
__exception__ May 20, 2023, 4:18 p.m.	stacktrace: MkcDIl34k3Si+0xca JDuCS622tuL6-0x2736 mn+0x21c6a @ 0x7fef3d11c6a rundll32+0x2f42 @ 0xff302f42 rundll32+0x3b7a @ 0xff303b7a BaseThreadInitThunk+0xd CreateThread-0x53 kernel32+0x1652d @ 0x76fd652d RtlUserThreadStart+0x21 strchr-0x3df ntdll+0x2c521 @ 0x776ec521 exception.instruction_r: 89 81 c8 00 00 00 8b 44 24 64 35 88 0f 00 00 39 exception.instruction: mov dword ptr [rcx + 0xc8], eax exception.exception_code: 0xc0000005 exception.symbol: MkcDIl34k3Si+0xca JDuCS622tuL6-0x2736 mn+0x21c6a exception.address: 0x7fef3d11c6a registers.r14: 0 registers.r15: 0 registers.rcx: 8791771393930 registers.rsi: 0 registers.r10: 0 registers.rbx: 0 registers.rsp: 1440752 registers.r11: 1439840 registers.r8: 2736500 registers.r9: 10 registers.rdx: 4281335808 registers.r12: 0 registers.rbp: 0 registers.rdi: 0 registers.rax: 544438 registers.r13: 0	1	0	0

Allocates read-write-execute memory (usually to unpack itself) (9 events)

Time & API	Arguments	Status
NtAllocateVirtualMemory May 20, 2023, 4:18 p.m.	process_identifier: 2620 region_size: 520192 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0000000001e50000 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory May 20, 2023, 4:18 p.m.	process_identifier: 2620 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0000000077711000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory May 20, 2023, 4:18 p.m.	process_identifier: 2620 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0000000077711000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory May 20, 2023, 4:18 p.m.	process_identifier: 2620 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0000000077711000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory May 20, 2023, 4:18 p.m.	process_identifier: 2620 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0000000077711000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory May 20, 2023, 4:18 p.m.	process_identifier: 2620 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0000000077711000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory May 20, 2023, 4:18 p.m.	process_identifier: 2620 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0000000077711000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory May 20, 2023, 4:18 p.m.	process_identifier: 2620 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0000000077711000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory May 20, 2023, 4:18 p.m.	process_identifier: 2620 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0000000077711000 process_handle: 0xffffffffffffffff	1

The binary likely contains encrypted or compressed data indicative of a packer (3 events)

section

{u'size_of_data': u'0x0005e800', u'virtual_address': u'0x00025000', u'entropy': 7.309811300445424, u'name': u'.rdata', u'virtual_size': u'0x0005e684'}

entropy

7.30981130045

description

A section with a high entropy has been found

section

{u'size_of_data': u'0x000a5400', u'virtual_address': u'0x00084000', u'entropy': 6.919657530421456, u'name': u'.data', u'virtual_size': u'0x000a67d8'}

entropy

6.91965753042

description

A section with a high entropy has been found

entropy

0.871278825996

description

Overall entropy of this PE file is high

Communicates with host for which no DNS query was performed (6 events)

host	2.228.251.38
host	214.43.249.250
host	34.254.140.99
host	57.182.80.190
host	62.4.213.138
host	92.119.178.40

Connects to IP addresses that are no longer responding to requests (legitimate services will remain up-and-running usually) (5 events)

dead_host	34.254.140.99:338
dead_host	214.43.249.250:195
dead_host	57.182.80.190:461
dead_host	2.228.251.38:346
dead_host	62.4.213.138:134

mn.php

Process Tree Toggle all

Network Toggle all

Suricata Toggle all

Suricata Alerts

Suricata TLS

Signatures Toggle All