trxV9376| Category | Machine | Started | Completed |
|---|---|---|---|
| FILE | s1_win7_x6402 | Aug. 22, 2023, 5:17 p.m. | Aug. 22, 2023, 5:18 p.m. |
-
regsvr32.exe "C:\Windows\System32\regsvr32.exe" C:\Users\test22\AppData\Local\Temp\trxV9376.dll,AaVQghYMoDvlcIkoDhwOzm
2252 -
regsvr32.exe "C:\Windows\System32\regsvr32.exe" C:\Users\test22\AppData\Local\Temp\trxV9376.dll,AbGiqsZapYXQEJBQNrWj
2368 -
regsvr32.exe "C:\Windows\System32\regsvr32.exe" C:\Users\test22\AppData\Local\Temp\trxV9376.dll,AFxNCNDhpJUjLGSUBdyJAlirW
3000 -
regsvr32.exe "C:\Windows\System32\regsvr32.exe" C:\Users\test22\AppData\Local\Temp\trxV9376.dll,AcIMOdUMWKfNaHjlQaJhaKDTvv
1648 -
regsvr32.exe "C:\Windows\System32\regsvr32.exe" C:\Users\test22\AppData\Local\Temp\trxV9376.dll,APgLpQbnGOFg
612 -
regsvr32.exe "C:\Windows\System32\regsvr32.exe" C:\Users\test22\AppData\Local\Temp\trxV9376.dll,AjmdNJiPaRsRtAqadcjQnlCAvv
1044 -
regsvr32.exe "C:\Windows\System32\regsvr32.exe" C:\Users\test22\AppData\Local\Temp\trxV9376.dll,AmhroJJBvgsvk
2548 -
regsvr32.exe "C:\Windows\System32\regsvr32.exe" C:\Users\test22\AppData\Local\Temp\trxV9376.dll,BdxxRGs
2864 -
regsvr32.exe "C:\Windows\System32\regsvr32.exe" C:\Users\test22\AppData\Local\Temp\trxV9376.dll,BgAFcJi
204 -
regsvr32.exe "C:\Windows\System32\regsvr32.exe" C:\Users\test22\AppData\Local\Temp\trxV9376.dll,BlIVCeEMUhTYUniUkHlJscB
2360 -
regsvr32.exe "C:\Windows\System32\regsvr32.exe" C:\Users\test22\AppData\Local\Temp\trxV9376.dll,BleGyOkIaepldUi
1704 -
regsvr32.exe "C:\Windows\System32\regsvr32.exe" C:\Users\test22\AppData\Local\Temp\trxV9376.dll,BoepXZDDjhOrSbcuQncJB
2860 -
regsvr32.exe "C:\Windows\System32\regsvr32.exe" C:\Users\test22\AppData\Local\Temp\trxV9376.dll,BpzeaEnGa
2172 -
regsvr32.exe "C:\Windows\System32\regsvr32.exe" C:\Users\test22\AppData\Local\Temp\trxV9376.dll,BwCjRp
2412 -
regsvr32.exe "C:\Windows\System32\regsvr32.exe" C:\Users\test22\AppData\Local\Temp\trxV9376.dll,CFIstcx
2692 -
regsvr32.exe "C:\Windows\System32\regsvr32.exe" C:\Users\test22\AppData\Local\Temp\trxV9376.dll,CJsqCnAMpj
3036 -
regsvr32.exe "C:\Windows\System32\regsvr32.exe" C:\Users\test22\AppData\Local\Temp\trxV9376.dll,CNPpdSVcuSzviIZhvCWSTfhZ
756 -
regsvr32.exe "C:\Windows\System32\regsvr32.exe" C:\Users\test22\AppData\Local\Temp\trxV9376.dll,COOXnQoQSaTGSpWIAaSzo
2720 -
regsvr32.exe "C:\Windows\System32\regsvr32.exe" C:\Users\test22\AppData\Local\Temp\trxV9376.dll,CSUruSgGDFRVUvVHcTu
2396 -
regsvr32.exe "C:\Windows\System32\regsvr32.exe" C:\Users\test22\AppData\Local\Temp\trxV9376.dll,CTCQAClHYzuiPWfwqyQYV
832 -
regsvr32.exe "C:\Windows\System32\regsvr32.exe" C:\Users\test22\AppData\Local\Temp\trxV9376.dll,CeHgsCxOuoDTDrP
2824 -
regsvr32.exe "C:\Windows\System32\regsvr32.exe" C:\Users\test22\AppData\Local\Temp\trxV9376.dll,CpbkGyHjPVYKKbevwuabtfos
1368 -
regsvr32.exe "C:\Windows\System32\regsvr32.exe" C:\Users\test22\AppData\Local\Temp\trxV9376.dll,DIczDdVVlD
3180 -
regsvr32.exe "C:\Windows\System32\regsvr32.exe" C:\Users\test22\AppData\Local\Temp\trxV9376.dll,DXtcAMkZFB
3308 -
regsvr32.exe "C:\Windows\System32\regsvr32.exe" C:\Users\test22\AppData\Local\Temp\trxV9376.dll,DahoeOjCy
3436 -
regsvr32.exe "C:\Windows\System32\regsvr32.exe" C:\Users\test22\AppData\Local\Temp\trxV9376.dll,DdmfNyLzGBEZdhjuVaLnGLAC
3568 -
regsvr32.exe "C:\Windows\System32\regsvr32.exe" C:\Users\test22\AppData\Local\Temp\trxV9376.dll,DllRegisterServer
3692 -
regsvr32.exe "C:\Windows\System32\regsvr32.exe" C:\Users\test22\AppData\Local\Temp\trxV9376.dll,EDirxlezljynQMb
3796 -
regsvr32.exe "C:\Windows\System32\regsvr32.exe" C:\Users\test22\AppData\Local\Temp\trxV9376.dll,EJrkYuGqWKJxcbkEWFxWuj
3916 -
regsvr32.exe "C:\Windows\System32\regsvr32.exe" C:\Users\test22\AppData\Local\Temp\trxV9376.dll,EOCBExEDvmpuiTSdISaFTJpbnD
4020 -
regsvr32.exe "C:\Windows\System32\regsvr32.exe" C:\Users\test22\AppData\Local\Temp\trxV9376.dll,ERdHSxbrluXBmlg
2504 -
regsvr32.exe "C:\Windows\System32\regsvr32.exe" C:\Users\test22\AppData\Local\Temp\trxV9376.dll,EWqRXzEYZJPwDvIiOC
3268 -
regsvr32.exe "C:\Windows\System32\regsvr32.exe" C:\Users\test22\AppData\Local\Temp\trxV9376.dll,EbquiojgkxAH
3532 -
regsvr32.exe "C:\Windows\System32\regsvr32.exe" C:\Users\test22\AppData\Local\Temp\trxV9376.dll,EjCrzK
3660 -
regsvr32.exe "C:\Windows\System32\regsvr32.exe" C:\Users\test22\AppData\Local\Temp\trxV9376.dll,FSJZHjqXtVCcouB
3840 -
regsvr32.exe "C:\Windows\System32\regsvr32.exe" C:\Users\test22\AppData\Local\Temp\trxV9376.dll,FmgnZSs
3820 -
regsvr32.exe "C:\Windows\System32\regsvr32.exe" C:\Users\test22\AppData\Local\Temp\trxV9376.dll,FwGMzFvmlRhqfdgYj
3144 -
regsvr32.exe "C:\Windows\System32\regsvr32.exe" C:\Users\test22\AppData\Local\Temp\trxV9376.dll,GEakZdngEgkQEMUw
3280 -
regsvr32.exe "C:\Windows\System32\regsvr32.exe" C:\Users\test22\AppData\Local\Temp\trxV9376.dll,GIucseXHMrRrXPFeKw
3612 -
regsvr32.exe "C:\Windows\System32\regsvr32.exe" C:\Users\test22\AppData\Local\Temp\trxV9376.dll,GNoduqRICMxxYLScjzRR
3936 -
regsvr32.exe "C:\Windows\System32\regsvr32.exe" C:\Users\test22\AppData\Local\Temp\trxV9376.dll,GTdkEFQtZIyifVPtMw
3932 -
regsvr32.exe "C:\Windows\System32\regsvr32.exe" C:\Users\test22\AppData\Local\Temp\trxV9376.dll,GUUIOYFVBkCRKKGPM
3500 -
regsvr32.exe "C:\Windows\System32\regsvr32.exe" C:\Users\test22\AppData\Local\Temp\trxV9376.dll,GabGyY
3864 -
regsvr32.exe "C:\Windows\System32\regsvr32.exe" C:\Users\test22\AppData\Local\Temp\trxV9376.dll,GlmIPNFEUxGfzccoGbGvt
3364 -
regsvr32.exe "C:\Windows\System32\regsvr32.exe" C:\Users\test22\AppData\Local\Temp\trxV9376.dll,GqxGeRkjCFW
4012 -
regsvr32.exe "C:\Windows\System32\regsvr32.exe" C:\Users\test22\AppData\Local\Temp\trxV9376.dll,GrnXAG
3844 -
regsvr32.exe "C:\Windows\System32\regsvr32.exe" C:\Users\test22\AppData\Local\Temp\trxV9376.dll,GsRUyGCvRhXYbBNdoXgMoD
3460 -
regsvr32.exe "C:\Windows\System32\regsvr32.exe" C:\Users\test22\AppData\Local\Temp\trxV9376.dll,GyQSbTrVGUQXgOfZOvlwGGJOZ
4112 -
regsvr32.exe "C:\Windows\System32\regsvr32.exe" C:\Users\test22\AppData\Local\Temp\trxV9376.dll,HCaLEQxCPhokiggZc
4220 -
regsvr32.exe "C:\Windows\System32\regsvr32.exe" C:\Users\test22\AppData\Local\Temp\trxV9376.dll,HETlXz
4320 -
regsvr32.exe "C:\Windows\System32\regsvr32.exe" C:\Users\test22\AppData\Local\Temp\trxV9376.dll,HRQNzHLCNHYjXY
4444 -
regsvr32.exe "C:\Windows\System32\regsvr32.exe" C:\Users\test22\AppData\Local\Temp\trxV9376.dll,HbOXELXYC
4572 -
regsvr32.exe "C:\Windows\System32\regsvr32.exe" C:\Users\test22\AppData\Local\Temp\trxV9376.dll,ISKZiApGwwqfPxyvDE
4668 -
regsvr32.exe "C:\Windows\System32\regsvr32.exe" C:\Users\test22\AppData\Local\Temp\trxV9376.dll,IcSKMpKalYoTBtNC
4776 -
regsvr32.exe "C:\Windows\System32\regsvr32.exe" C:\Users\test22\AppData\Local\Temp\trxV9376.dll,IprhqRmUjfLjdAvaVSyh
4900 -
regsvr32.exe "C:\Windows\System32\regsvr32.exe" C:\Users\test22\AppData\Local\Temp\trxV9376.dll,IsZFDjJYWWGraQqQsCIojuoPI
5004 -
regsvr32.exe "C:\Windows\System32\regsvr32.exe" C:\Users\test22\AppData\Local\Temp\trxV9376.dll,ItCdjvWTgdRQjqKEojXISZB
4104 -
regsvr32.exe "C:\Windows\System32\regsvr32.exe" C:\Users\test22\AppData\Local\Temp\trxV9376.dll,JEVIhwFBZItxqXVhyUDXDtvW
4244 -
regsvr32.exe "C:\Windows\System32\regsvr32.exe" C:\Users\test22\AppData\Local\Temp\trxV9376.dll,JEhcfsFJLI
4232 -
regsvr32.exe "C:\Windows\System32\regsvr32.exe" C:\Users\test22\AppData\Local\Temp\trxV9376.dll,JhsVgkWwuNGjkVJBv
4620 -
regsvr32.exe "C:\Windows\System32\regsvr32.exe" C:\Users\test22\AppData\Local\Temp\trxV9376.dll,JiXLWADK
4816 -
regsvr32.exe "C:\Windows\System32\regsvr32.exe" C:\Users\test22\AppData\Local\Temp\trxV9376.dll,JkvQVFXLk
4936 -
regsvr32.exe "C:\Windows\System32\regsvr32.exe" C:\Users\test22\AppData\Local\Temp\trxV9376.dll,JqTVuEmdOv
5012 -
regsvr32.exe "C:\Windows\System32\regsvr32.exe" C:\Users\test22\AppData\Local\Temp\trxV9376.dll,JuvMSMMEvEF
4348 -
regsvr32.exe "C:\Windows\System32\regsvr32.exe" C:\Users\test22\AppData\Local\Temp\trxV9376.dll,KDwYBJCicCZzRoOZ
4588 -
regsvr32.exe "C:\Windows\System32\regsvr32.exe" C:\Users\test22\AppData\Local\Temp\trxV9376.dll,KLAfQsdsaKGHSrQOYTMpVzgK
4836 -
regsvr32.exe "C:\Windows\System32\regsvr32.exe" C:\Users\test22\AppData\Local\Temp\trxV9376.dll,KSnZqpvzTNl
5092 -
regsvr32.exe "C:\Windows\System32\regsvr32.exe" C:\Users\test22\AppData\Local\Temp\trxV9376.dll,KWfbJvRFrOV
4360 -
regsvr32.exe "C:\Windows\System32\regsvr32.exe" C:\Users\test22\AppData\Local\Temp\trxV9376.dll,KcugiBMUcgjkCqc
4976 -
regsvr32.exe "C:\Windows\System32\regsvr32.exe" C:\Users\test22\AppData\Local\Temp\trxV9376.dll,KidKIFrYdPHAre
4332 -
regsvr32.exe "C:\Windows\System32\regsvr32.exe" C:\Users\test22\AppData\Local\Temp\trxV9376.dll,KlkHRlyspyEbCqaAF
5072
| Name | Response | Post-Analysis Lookup |
|---|---|---|
| No hosts contacted. | ||
| IP Address | Status | Action |
|---|---|---|
| 164.124.101.2 | Active | Moloch |
Suricata Alerts
No Suricata Alerts
Suricata TLS
No Suricata TLS
| resource name | TZU |
| section | {u'size_of_data': u'0x0002b200', u'virtual_address': u'0x00065000', u'entropy': 7.772240674390569, u'name': u'.rsrc', u'virtual_size': u'0x0002b060'} | entropy | 7.77224067439 | description | A section with a high entropy has been found | |||||||||
| entropy | 0.307760927743 | description | Overall entropy of this PE file is high | |||||||||||
| Bkav | W32.AIDetectMalware.64 |
| Lionic | Trojan.Win32.Emotet.L!c |
| MicroWorld-eScan | Gen:Variant.Ulise.405919 |
| FireEye | Gen:Variant.Ulise.405919 |
| McAfee | Emotet-FUD!C901C8089C5E |
| Cylance | unsafe |
| Zillya | Trojan.Emotet.Win64.712 |
| Sangfor | Spyware.Win64.Emotet.Vjsd |
| K7AntiVirus | Trojan ( 0059b58d1 ) |
| Alibaba | TrojanBanker:Win64/Emotet.f53d6a7c |
| K7GW | Trojan ( 0059b58d1 ) |
| CrowdStrike | win/malicious_confidence_100% (W) |
| Arcabit | Trojan.Ulise.D6319F |
| VirIT | Trojan.Win64.Emotet.DPQ |
| Cyren | W64/Emotet.BGN.gen!Eldorado |
| Symantec | Trojan Horse |
| Elastic | malicious (high confidence) |
| ESET-NOD32 | Win64/Emotet.AL |
| Cynet | Malicious (score: 99) |
| Kaspersky | Trojan-Banker.Win64.Emotet.cmvs |
| BitDefender | Gen:Variant.Ulise.405919 |
| NANO-Antivirus | Trojan.Win64.Emotet.jvobvn |
| Avast | Win64:BankerX-gen [Trj] |
| Tencent | Malware.Win32.Gencirc.118bf89d |
| Emsisoft | Gen:Variant.Ulise.405919 (B) |
| F-Secure | Trojan.TR/Agent.aogi |
| DrWeb | Trojan.Emotet.1310 |
| VIPRE | Gen:Variant.Ulise.405919 |
| TrendMicro | TrojanSpy.Win64.EMOTET.YXDCQZ |
| McAfee-GW-Edition | Emotet-FUD!C901C8089C5E |
| Sophos | Troj/Emotet-DCT |
| Jiangmin | Trojan.Banker.Emotet.scv |
| Webroot | W32.Trojan.Emotet |
| Avira | TR/Agent.aogi |
| Antiy-AVL | Trojan/Win64.GenKryptik |
| Gridinsoft | Malware.Win64.Emotet.bot |
| Xcitium | Malware@#1f2osespawys |
| Microsoft | Trojan:Win32/Emotet!ic |
| ZoneAlarm | Trojan-Banker.Win64.Emotet.cmvs |
| GData | Gen:Variant.Ulise.405919 |
| Detected | |
| AhnLab-V3 | Trojan/Win.Emotet.R564334 |
| VBA32 | TrojanBanker.Emotet |
| ALYac | Trojan.Agent.Emotet |
| MAX | malware (ai score=100) |
| Malwarebytes | Crypt.Trojan.MSIL.DDS |
| Panda | Trj/Chgt.AD |
| TrendMicro-HouseCall | TrojanSpy.Win64.EMOTET.YXDCQZ |
| Rising | Trojan.Kryptik!8.8 (TFE:5:F5gXdyKd7lN) |
| Yandex | Trojan.Emotet!NeE/T5E6Ku8 |