Favorites
Tools
Dr.Zero Chatbot
Notifications
Guide 2020-06-10
Version history 2020-06-10

Summary | ZeroBOX

rockol.exe

RedLine Infostealer RedLine stealer .NET framework(MSIL) Confuser .NET UPX PE File OS Processor Check PE32 .NET EXE

Category	Machine	Started	Completed
FILE	s1_win7_x6403_us	July 19, 2023, 7:14 a.m.	July 19, 2023, 7:17 a.m.

Size	172.5KB
Type	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
MD5	`df7a39c6a0b49b73bb6acd435f073166`
SHA256	`2fa67b1856ac00a4e234816ba09e5339d7649e8f56b42c554b14c7e85e07bbfa`
CRC32	`BFD703F1`
ssdeep	`3072:VjDidCJhNPwF6VNwLxNG6SwXOPyhBee8e8h7:lDd7PxVqyJPyhBee`
Yara	UPX_Zero - UPX packed file OS_Processor_Check_Zero - OS Processor Check MALWARE_Win_VT_RedLine - Detects RedLine infostealer Win32_Trojan_PWS_Net_1_Zero - Win32 Trojan PWS .NET Azorult Is_DotNET_EXE - (no description) RedLine_Stealer_b_Zero - RedLine stealer PE_Header_Zero - PE File Signature ConfuserEx_Zero - Confuser .NET IsPE32 - (no description)

rockol.exe "C:\Users\test22\AppData\Local\Temp\rockol.exe"
1696

Name	Response	Post-Analysis Lookup
No hosts contacted.

IP Address	Status	Action
No hosts contacted.

Suricata Alerts

No Suricata Alerts

Suricata TLS

No Suricata TLS

Queries for the computername (2 events)

Time & API	Arguments	Status	Return	Repeated
GetComputerNameA July 19, 2023, 7:14 a.m.	computer_name: TEST22-PC	1	1	0
GetComputerNameW July 19, 2023, 7:14 a.m.	computer_name: TEST22-PC	1	1	0

Checks if process is being debugged by a debugger (4 events)

Time & API	Arguments	Status	Return	Repeated
IsDebuggerPresent July 19, 2023, 7:14 a.m.			0	0
IsDebuggerPresent July 19, 2023, 7:14 a.m.			0	0
IsDebuggerPresent July 19, 2023, 7:14 a.m.			0	0
IsDebuggerPresent July 19, 2023, 7:14 a.m.			0	0

Checks amount of memory in system, this can be used to detect virtual machines that have a low amount of memory available (1 event)

Time & API	Arguments	Status	Return	Repeated
GlobalMemoryStatusEx July 19, 2023, 7:14 a.m.		1	1	0

Allocates read-write-execute memory (usually to unpack itself) (11 events)

Time & API	Arguments	Status	Return	Repeated
NtAllocateVirtualMemory July 19, 2023, 7:14 a.m.	process_identifier: 1696 region_size: 458752 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00440000 allocation_type: 8192 (MEM_RESERVE) process_handle: 0xffffffff	1	0	0
NtAllocateVirtualMemory July 19, 2023, 7:14 a.m.	process_identifier: 1696 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00470000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1	0	0
NtProtectVirtualMemory July 19, 2023, 7:14 a.m.	process_identifier: 1696 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x73f31000 process_handle: 0xffffffff	1	0	0
NtProtectVirtualMemory July 19, 2023, 7:14 a.m.	process_identifier: 1696 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x73f32000 process_handle: 0xffffffff	1	0	0
NtAllocateVirtualMemory July 19, 2023, 7:14 a.m.	process_identifier: 1696 region_size: 1572864 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x02040000 allocation_type: 8192 (MEM_RESERVE) process_handle: 0xffffffff	1	0	0
NtAllocateVirtualMemory July 19, 2023, 7:14 a.m.	process_identifier: 1696 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x02180000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1	0	0
NtAllocateVirtualMemory July 19, 2023, 7:14 a.m.	process_identifier: 1696 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00322000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1	0	0
NtAllocateVirtualMemory July 19, 2023, 7:14 a.m.	process_identifier: 1696 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0032a000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1	0	0
NtAllocateVirtualMemory July 19, 2023, 7:14 a.m.	process_identifier: 1696 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0045b000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1	0	0
NtAllocateVirtualMemory July 19, 2023, 7:14 a.m.	process_identifier: 1696 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00457000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1	0	0
NtAllocateVirtualMemory July 19, 2023, 7:14 a.m.	process_identifier: 1696 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00455000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1	0	0