Summary | ZeroBOX

Category	Machine	Started	Completed
FILE	s1_win7_x6402	May 22, 2023, 9:05 a.m.	May 22, 2023, 9:08 a.m.

Size	1.2MB
Type	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
MD5	`78b53767df514a3d25aed7b2befbf562`
SHA256	`8b3d515b20f71411967cf885f6b85be1082c2113bc3930fd71020765edf3c036`
CRC32	`1A978FED`
ssdeep	`24576:DV0UU15cjJZQl3+S+sv6QCQEmwyhFz/1azp3Olzdd+B4/:Vw5L+h1nWk3WzvV`
Yara	UPX_Zero - UPX packed file OS_Processor_Check_Zero - OS Processor Check Malicious_Library_Zero - Malicious_Library IsDLL - (no description) IsPE64 - (no description) PE_Header_Zero - PE File Signature

rundll32.exe "C:\Windows\System32\rundll32.exe" C:\Users\test22\AppData\Local\Temp\goat.dll,JDuCS622tuL6
3028
- rundll32.exe "C:\Windows\System32\rundll32.exe" C:\Users\test22\AppData\Local\Temp\goat.dll,JDuCS622tuL6
  2520
rundll32.exe "C:\Windows\System32\rundll32.exe" C:\Users\test22\AppData\Local\Temp\goat.dll,PcYge9j
2260
- rundll32.exe "C:\Windows\System32\rundll32.exe" C:\Users\test22\AppData\Local\Temp\goat.dll,PcYge9j
  572
rundll32.exe "C:\Windows\System32\rundll32.exe" C:\Users\test22\AppData\Local\Temp\goat.dll,eOXScagadNKe
2412
- rundll32.exe "C:\Windows\System32\rundll32.exe" C:\Users\test22\AppData\Local\Temp\goat.dll,eOXScagadNKe
  1560
rundll32.exe "C:\Windows\System32\rundll32.exe" C:\Users\test22\AppData\Local\Temp\goat.dll,MkcDIl34k3Si
2216
- rundll32.exe "C:\Windows\System32\rundll32.exe" C:\Users\test22\AppData\Local\Temp\goat.dll,MkcDIl34k3Si
  1508
rundll32.exe "C:\Windows\System32\rundll32.exe" C:\Users\test22\AppData\Local\Temp\goat.dll,
1608

Name	Response	Post-Analysis Lookup
No hosts contacted.

IP Address	Status	Action
164.124.101.2	Active	Moloch
2.228.251.38	Active	Moloch
214.43.249.250	Active	Moloch
57.182.80.190	Active	Moloch
62.4.213.138	Active	Moloch
92.119.178.40	Active	Moloch

Suricata Alerts

No Suricata Alerts

Suricata TLS

No Suricata TLS

Queries for the computername (4 events)

Time & API	Arguments	Status	Return
GetComputerNameW May 22, 2023, 9:06 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameW May 22, 2023, 9:06 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameW May 22, 2023, 9:06 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameW May 22, 2023, 9:06 a.m.	computer_name: TEST22-PC	1	1

Checks if process is being debugged by a debugger (4 events)

Time & API	Arguments	Status	Return	Repeated
IsDebuggerPresent May 22, 2023, 9:05 a.m.			0	0
IsDebuggerPresent May 22, 2023, 9:05 a.m.			0	0
IsDebuggerPresent May 22, 2023, 9:05 a.m.			0	0
IsDebuggerPresent May 22, 2023, 9:05 a.m.			0	0

The executable contains unknown PE section names indicative of a packer (could be a false positive) (1 event)

section

.gfids

One or more processes crashed (2 events)

Time & API	Arguments	Status	Return	Repeated
__exception__ May 22, 2023, 9:05 a.m.	stacktrace: PcYge9j-0x717f goat+0x10d1 @ 0x7fef32610d1 JDuCS622tuL6+0x4cd goat+0x2485d @ 0x7fef328485d rundll32+0x2f42 @ 0xff862f42 rundll32+0x3b7a @ 0xff863b7a BaseThreadInitThunk+0xd CreateThread-0x53 kernel32+0x1652d @ 0x7718652d RtlUserThreadStart+0x21 strchr-0x3df ntdll+0x2c521 @ 0x772bc521 exception.instruction_r: 89 81 ec 00 00 00 8b 44 24 50 05 a5 02 00 00 89 exception.instruction: mov dword ptr [rcx + 0xec], eax exception.exception_code: 0xc0000005 exception.symbol: PcYge9j-0x717f goat+0x10d1 exception.address: 0x7fef32610d1 registers.r14: 0 registers.r15: 0 registers.rcx: 131436 registers.rsi: 0 registers.r10: 0 registers.rbx: 0 registers.rsp: 2161840 registers.r11: 2160928 registers.r8: 4294964182 registers.r9: 131436 registers.rdx: 4286968217 registers.r12: 0 registers.rbp: 0 registers.rdi: 0 registers.rax: 4033801131 registers.r13: 0	1	0	0
__exception__ May 22, 2023, 9:05 a.m.	stacktrace: MkcDIl34k3Si+0xcf JDuCS622tuL6-0x2721 goat+0x21c6f @ 0x7fef3281c6f rundll32+0x2f42 @ 0xff862f42 rundll32+0x3b7a @ 0xff863b7a BaseThreadInitThunk+0xd CreateThread-0x53 kernel32+0x1652d @ 0x7718652d RtlUserThreadStart+0x21 strchr-0x3df ntdll+0x2c521 @ 0x772bc521 exception.instruction_r: 89 81 c8 00 00 00 8b 44 24 64 35 db 2d 00 00 39 exception.instruction: mov dword ptr [rcx + 0xc8], eax exception.exception_code: 0xc0000005 exception.symbol: MkcDIl34k3Si+0xcf JDuCS622tuL6-0x2721 goat+0x21c6f exception.address: 0x7fef3281c6f registers.r14: 0 registers.r15: 0 registers.rcx: 8791783518090 registers.rsi: 0 registers.r10: 0 registers.rbx: 0 registers.rsp: 1702544 registers.r11: 1701632 registers.r8: 3260784 registers.r9: 10 registers.rdx: 4286971904 registers.r12: 0 registers.rbp: 0 registers.rdi: 0 registers.rax: 544438 registers.r13: 0	1	0	0

Allocates read-write-execute memory (usually to unpack itself) (13 events)

Time & API	Arguments	Status
NtProtectVirtualMemory May 22, 2023, 9:05 a.m.	process_identifier: 2520 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fefa1b7000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory May 22, 2023, 9:05 a.m.	process_identifier: 1508 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fefa1b7000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory May 22, 2023, 9:05 a.m.	process_identifier: 572 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fefa1b7000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory May 22, 2023, 9:05 a.m.	process_identifier: 1560 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fefa1b7000 process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory May 22, 2023, 9:06 a.m.	process_identifier: 1560 region_size: 520192 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0000000001d10000 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory May 22, 2023, 9:06 a.m.	process_identifier: 1560 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00000000772e1000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory May 22, 2023, 9:06 a.m.	process_identifier: 1560 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00000000772e1000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory May 22, 2023, 9:06 a.m.	process_identifier: 1560 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00000000772e1000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory May 22, 2023, 9:06 a.m.	process_identifier: 1560 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00000000772e1000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory May 22, 2023, 9:06 a.m.	process_identifier: 1560 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00000000772e1000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory May 22, 2023, 9:06 a.m.	process_identifier: 1560 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00000000772e1000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory May 22, 2023, 9:06 a.m.	process_identifier: 1560 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00000000772e1000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory May 22, 2023, 9:06 a.m.	process_identifier: 1560 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00000000772e1000 process_handle: 0xffffffffffffffff	1

The binary likely contains encrypted or compressed data indicative of a packer (3 events)

section

{u'size_of_data': u'0x0005ea00', u'virtual_address': u'0x00025000', u'entropy': 7.310871992005833, u'name': u'.rdata', u'virtual_size': u'0x0005e854'}

entropy

7.31087199201

description

A section with a high entropy has been found

section

{u'size_of_data': u'0x000a5400', u'virtual_address': u'0x00084000', u'entropy': 6.918212866317822, u'name': u'.data', u'virtual_size': u'0x000a66d8'}

entropy

6.91821286632

description

A section with a high entropy has been found

entropy

0.871332774518

description

Overall entropy of this PE file is high

Communicates with host for which no DNS query was performed (5 events)

host	2.228.251.38
host	214.43.249.250
host	57.182.80.190
host	62.4.213.138
host	92.119.178.40

Connects to IP addresses that are no longer responding to requests (legitimate services will remain up-and-running usually) (5 events)

dead_host	214.43.249.250:195
dead_host	92.119.178.40:443
dead_host	2.228.251.38:346
dead_host	62.4.213.138:134
dead_host	57.182.80.190:461

goat.dll

Process Tree Toggle all

Network Toggle all

Suricata Toggle all

Suricata Alerts

Suricata TLS

Signatures Toggle All