popup
Summary | ZeroBOX
  1. Home
  2. Result
  3. Report
  4. Detail Analysis

dllhostex.exe

Malicious Library UPX Malicious Packer PE File OS Processor Check PE32
  1. Resubmit sample
Category Machine Started Completed
FILE s1_win7_x6402 Nov. 16, 2023, 6:57 p.m. Nov. 16, 2023, 7:02 p.m.
Size 1.3MB
Type PE32 executable (console) Intel 80386, for MS Windows
MD5 f5a7b1f998390241f5c10cbddfe88647
SHA256 5cd9ff29454e84923d4178484ecfb3bc48561d4401fa94b98f9d2693d47a740a
CRC32 4AC43571
ssdeep 24576:wOTuFoSUpzjLJrr4FtnILnSqmdoRdSeUSjguAF11N0i7TwONgV0HL1z9ChftQAg+:2oSUpzjLJYFtnILtmdoRdgSjguA30i76
Yara
  • Malicious_Library_Zero - Malicious_Library
  • IsPE32 - (no description)
  • Malicious_Packer_Zero - Malicious Packer
  • PE_Header_Zero - PE File Signature
  • UPX_Zero - UPX packed file
  • OS_Processor_Check_Zero - OS Processor Check

Name Response Post-Analysis Lookup
iron.tenchier.com
A 139.177.196.162
CNAME o.auntions.com
A 139.59.109.18
A 194.195.223.249
194.195.223.249
IP Address Status Action
139.177.196.162 Active Moloch
139.59.109.18 Active Moloch
164.124.101.2 Active Moloch
194.195.223.249 Active Moloch

Suricata Alerts

Flow SID Signature Category
TCP 192.168.56.102:49164 -> 139.177.196.162:443 2024792 ET POLICY Cryptocurrency Miner Checkin Potential Corporate Privacy Violation
TCP 192.168.56.102:49167 -> 139.177.196.162:443 2024792 ET POLICY Cryptocurrency Miner Checkin Potential Corporate Privacy Violation
TCP 192.168.56.102:49174 -> 139.177.196.162:443 2024792 ET POLICY Cryptocurrency Miner Checkin Potential Corporate Privacy Violation
TCP 192.168.56.102:49176 -> 139.177.196.162:443 2024792 ET POLICY Cryptocurrency Miner Checkin Potential Corporate Privacy Violation
TCP 192.168.56.102:49164 -> 139.177.196.162:443 2024792 ET POLICY Cryptocurrency Miner Checkin Potential Corporate Privacy Violation
TCP 192.168.56.102:49176 -> 139.177.196.162:443 2024792 ET POLICY Cryptocurrency Miner Checkin Potential Corporate Privacy Violation
TCP 192.168.56.102:49174 -> 139.177.196.162:443 2024792 ET POLICY Cryptocurrency Miner Checkin Potential Corporate Privacy Violation
TCP 192.168.56.102:49167 -> 139.177.196.162:443 2024792 ET POLICY Cryptocurrency Miner Checkin Potential Corporate Privacy Violation

Suricata TLS

No Suricata TLS

Time & API Arguments Status Return Repeated

NtAllocateVirtualMemory

 process_identifier: 3020
region_size: 16384
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x00890000
allocation_type: 12288 (MEM_COMMIT|MEM_RESERVE)
process_handle: 0xffffffff
1 0 0
description dllhostex.exe tried to sleep 288 seconds, actually delayed analysis time by 288 seconds
Time & API Arguments Status Return Repeated

GetAdaptersAddresses

 flags: 14
family: 0
111 0
dead_host 139.59.109.18:443
dead_host 194.195.223.249:443