Summary | ZeroBOX

Category	Machine	Started	Completed
FILE	s1_win7_x6401	May 20, 2023, 4:18 p.m.	May 20, 2023, 4:26 p.m.

Size	1.2MB
Type	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
MD5	`f19e4ec96f8b163760b236127387c5a8`
SHA256	`af2df15590ceead71690e885b743fe7cea32d6221b1569044898aa68cf12a9d1`
CRC32	`4B1C2E7C`
ssdeep	`24576:2l70x0gt0nxZLHfHulAR02Sq2lr5ljm/91JGvd+mmiSyZHpVMXD+mwCyWJD8:J/I/OlARNSq2ShiVH7oZlJD8`
Yara	UPX_Zero - UPX packed file OS_Processor_Check_Zero - OS Processor Check Malicious_Library_Zero - Malicious_Library IsDLL - (no description) IsPE64 - (no description) PE_Header_Zero - PE File Signature

rundll32.exe "C:\Windows\System32\rundll32.exe" C:\Users\test22\AppData\Local\Temp\mn.php.dll,JDuCS622tuL6
2632
- rundll32.exe "C:\Windows\System32\rundll32.exe" C:\Users\test22\AppData\Local\Temp\mn.php.dll,JDuCS622tuL6
  3016
rundll32.exe "C:\Windows\System32\rundll32.exe" C:\Users\test22\AppData\Local\Temp\mn.php.dll,MkcDIl34k3Si
2728
- rundll32.exe "C:\Windows\System32\rundll32.exe" C:\Users\test22\AppData\Local\Temp\mn.php.dll,MkcDIl34k3Si
  940
rundll32.exe "C:\Windows\System32\rundll32.exe" C:\Users\test22\AppData\Local\Temp\mn.php.dll,PcYge9j
2824
- rundll32.exe "C:\Windows\System32\rundll32.exe" C:\Users\test22\AppData\Local\Temp\mn.php.dll,PcYge9j
  908
rundll32.exe "C:\Windows\System32\rundll32.exe" C:\Users\test22\AppData\Local\Temp\mn.php.dll,eOXScagadNKe
2916
- rundll32.exe "C:\Windows\System32\rundll32.exe" C:\Users\test22\AppData\Local\Temp\mn.php.dll,eOXScagadNKe
  1336
rundll32.exe "C:\Windows\System32\rundll32.exe" C:\Users\test22\AppData\Local\Temp\mn.php.dll,
3004

Name	Response	Post-Analysis Lookup
No hosts contacted.

IP Address	Status	Action
164.124.101.2	Active	Moloch
2.228.251.38	Active	Moloch
214.43.249.250	Active	Moloch
34.254.140.99	Active	Moloch
57.182.80.190	Active	Moloch
62.4.213.138	Active	Moloch
92.119.178.40	Active	Moloch

Suricata Alerts

No Suricata Alerts

Suricata TLS

No Suricata TLS

Queries for the computername (4 events)

Time & API	Arguments	Status	Return
GetComputerNameW May 20, 2023, 4:18 p.m.	computer_name: TEST22-PC	1	1
GetComputerNameW May 20, 2023, 4:18 p.m.	computer_name: TEST22-PC	1	1
GetComputerNameW May 20, 2023, 4:18 p.m.	computer_name: TEST22-PC	1	1
GetComputerNameW May 20, 2023, 4:18 p.m.	computer_name: TEST22-PC	1	1

Checks if process is being debugged by a debugger (4 events)

Time & API	Arguments	Status	Return	Repeated
IsDebuggerPresent May 20, 2023, 4:18 p.m.			0	0
IsDebuggerPresent May 20, 2023, 4:18 p.m.			0	0
IsDebuggerPresent May 20, 2023, 4:18 p.m.			0	0
IsDebuggerPresent May 20, 2023, 4:18 p.m.			0	0

The executable contains unknown PE section names indicative of a packer (could be a false positive) (1 event)

section

.gfids

One or more processes crashed (2 events)

Time & API	Arguments	Status	Return	Repeated
__exception__ May 20, 2023, 4:18 p.m.	stacktrace: MkcDIl34k3Si+0xd2 JDuCS622tuL6-0x26fe mn+0x21c62 @ 0x7fef40f1c62 rundll32+0x2f42 @ 0xff992f42 rundll32+0x3b7a @ 0xff993b7a BaseThreadInitThunk+0xd CreateThread-0x53 kernel32+0x1652d @ 0x76c2652d RtlUserThreadStart+0x21 strchr-0x3df ntdll+0x2c521 @ 0x76d5c521 exception.instruction_r: 89 81 c8 00 00 00 8b 44 24 64 35 88 0f 00 00 39 exception.instruction: mov dword ptr [rcx + 0xc8], eax exception.exception_code: 0xc0000005 exception.symbol: MkcDIl34k3Si+0xd2 JDuCS622tuL6-0x26fe mn+0x21c62 exception.address: 0x7fef40f1c62 registers.r14: 0 registers.r15: 0 registers.rcx: 8791759269770 registers.rsi: 0 registers.r10: 0 registers.rbx: 0 registers.rsp: 1636464 registers.r11: 1635552 registers.r8: 3326132 registers.r9: 10 registers.rdx: 4288217088 registers.r12: 0 registers.rbp: 0 registers.rdi: 0 registers.rax: 544438 registers.r13: 0	1	0	0
__exception__ May 20, 2023, 4:18 p.m.	stacktrace: RtlInitAnsiStringEx+0x24 RtlUnicodeToMultiByteN-0x3c ntdll+0x557f4 @ 0x76d857f4 GetFileAttributesA+0x12 GetSystemDefaultLangID-0x7e kernelbase+0xadf2 @ 0x7fefd4fadf2 PcYge9j+0xe8 eOXScagadNKe-0x18158 mn+0x8328 @ 0x7fef40d8328 rundll32+0x2f42 @ 0xff992f42 rundll32+0x3b7a @ 0xff993b7a BaseThreadInitThunk+0xd CreateThread-0x53 kernel32+0x1652d @ 0x76c2652d RtlUserThreadStart+0x21 strchr-0x3df ntdll+0x2c521 @ 0x76d5c521 exception.instruction_r: f2 ae 48 8b 3c 24 48 f7 d1 48 ff c9 48 81 f9 fe exception.symbol: RtlInitAnsiStringEx+0x24 RtlUnicodeToMultiByteN-0x3c ntdll+0x557f4 exception.instruction: scasb al, byte ptr [rdi] exception.module: ntdll.dll exception.exception_code: 0xc0000005 exception.offset: 350196 exception.address: 0x76d857f4 registers.r14: 0 registers.r15: 0 registers.rcx: -1 registers.rsi: 0 registers.r10: 0 registers.rbx: 0 registers.rsp: 719872 registers.r11: 718960 registers.r8: 719200 registers.r9: 10 registers.rdx: 4282186963 registers.r12: 0 registers.rbp: 0 registers.rdi: 0 registers.rax: 0 registers.r13: 0	1	0	0

Allocates read-write-execute memory (usually to unpack itself) (13 events)

Time & API	Arguments	Status
NtProtectVirtualMemory May 20, 2023, 4:18 p.m.	process_identifier: 3016 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000000007304c000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory May 20, 2023, 4:18 p.m.	process_identifier: 940 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000000007304c000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory May 20, 2023, 4:18 p.m.	process_identifier: 908 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000000007304c000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory May 20, 2023, 4:18 p.m.	process_identifier: 1336 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000000007304c000 process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory May 20, 2023, 4:18 p.m.	process_identifier: 1336 region_size: 520192 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0000000001ee0000 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory May 20, 2023, 4:18 p.m.	process_identifier: 1336 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0000000076d81000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory May 20, 2023, 4:18 p.m.	process_identifier: 1336 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0000000076d81000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory May 20, 2023, 4:18 p.m.	process_identifier: 1336 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0000000076d81000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory May 20, 2023, 4:18 p.m.	process_identifier: 1336 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0000000076d81000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory May 20, 2023, 4:18 p.m.	process_identifier: 1336 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0000000076d81000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory May 20, 2023, 4:18 p.m.	process_identifier: 1336 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0000000076d81000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory May 20, 2023, 4:18 p.m.	process_identifier: 1336 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0000000076d81000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory May 20, 2023, 4:18 p.m.	process_identifier: 1336 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0000000076d81000 process_handle: 0xffffffffffffffff	1

The binary likely contains encrypted or compressed data indicative of a packer (3 events)

section

{u'size_of_data': u'0x0005ee00', u'virtual_address': u'0x00025000', u'entropy': 7.313905876086351, u'name': u'.rdata', u'virtual_size': u'0x0005ecc4'}

entropy

7.31390587609

description

A section with a high entropy has been found

section

{u'size_of_data': u'0x000a5400', u'virtual_address': u'0x00084000', u'entropy': 6.920310673731051, u'name': u'.data', u'virtual_size': u'0x000a66a8'}

entropy

6.92031067373

description

A section with a high entropy has been found

entropy

0.871440536013

description

Overall entropy of this PE file is high

Communicates with host for which no DNS query was performed (6 events)

host	2.228.251.38
host	214.43.249.250
host	34.254.140.99
host	57.182.80.190
host	62.4.213.138
host	92.119.178.40

Connects to IP addresses that are no longer responding to requests (legitimate services will remain up-and-running usually) (5 events)

dead_host	34.254.140.99:338
dead_host	214.43.249.250:195
dead_host	57.182.80.190:461
dead_host	2.228.251.38:346
dead_host	62.4.213.138:134

mn.php

Process Tree Toggle all

Network Toggle all

Suricata Toggle all

Suricata Alerts

Suricata TLS

Signatures Toggle All