Favorites
Tools
Dr.Zero Chatbot
Notifications
Guide 2020-06-10
Version history 2020-06-10

latestReport
09.23 11:09
wcxoplwq.exe
09.23 11:09
66f00f515201d_otr.exe#...
09.23 11:09
Journal.exe
09.23 11:09
PI No.1070034483.exe
09.23 11:09
66f011901da27_crypted....
09.23 11:09
66f063cce5470_crypted....
09.23 11:09
notebyx.exe
09.23 10:09
Uploader.exe
09.23 10:09
Trial.bat
09.23 10:09
Extension2.exe

Latest News
09.23 12:09
Indian Markets Calm Ma...
09.23 11:09
ISC Stormcast For Mond...
09.23 11:09
KCCI 한국소비자인증, 2024년 전국...
09.23 11:09
‘여기바바’, 특별한 순간을 기록하는 이...
09.23 11:09
The Tiny Toolkit Manif...
09.23 11:09
아이디벨롭 주식회사, 혁신적인 플랫폼 '...
09.23 11:09
K-시큐리티 얼라이언스 기업·솔루션 디렉...
09.23 10:09
세영정보통신, 실시간 통역 무선 통신 장...
09.23 10:09
큐브티켓, 2024년 소비자 브랜드 및 ...
09.23 10:09
모노리스, 9.81파크 제주 브랜드데이 ...

Summary | ZeroBOX

adobe.exe

Emotet Gen1 Generic Malware Malicious Library UPX Malicious Packer Admin Tool (Sysinternals etc ...) dll PE64 MZP Format PE File OS Processor Check PE32 ZIP Format wget DLL DllRegisterServer

Category	Machine	Started	Completed
FILE	s1_win7_x6401	Dec. 22, 2023, 8:08 a.m.	Dec. 22, 2023, 8:11 a.m.

Size	6.8MB
Type	PE32 executable (GUI) Intel 80386, for MS Windows
MD5	`a056c3e2e3334be82cc40e2af20ef67b`
SHA256	`08c28d575953f79f3a2f43d42ae913c36a450ad564547bf0b839c92d55c1a460`
CRC32	`D6258080`
ssdeep	`196608:zwDjImo2P0187y9klWkG5b1IUZIsySlp6UnHPF:AjIUP01LcWkG5b1IUIklpTHd`
Yara	Malicious_Library_Zero - Malicious_Library IsPE32 - (no description) Win32_Trojan_Emotet_2_Zero - Win32 Trojan Emotet PE_Header_Zero - PE File Signature UPX_Zero - UPX packed file mzp_file_format - MZP(Delphi) file format

adobe.exe "C:\Users\test22\AppData\Local\Temp\adobe.exe"
2556
- adobe.tmp "C:\Users\test22\AppData\Local\Temp\is-BJ47O.tmp\adobe.tmp" /SL5="$5011A,6845033,54272,C:\Users\test22\AppData\Local\Temp\adobe.exe"
  2608
  - rbuttontray.exe "C:\Program Files (x86)\RButtonTRAY\rbuttontray.exe" -i
    2700
  - rbuttontray.exe "C:\Program Files (x86)\RButtonTRAY\rbuttontray.exe" -s
    2752

Name	Response	Post-Analysis Lookup
No hosts contacted.

IP Address	Status	Action
No hosts contacted.

Suricata Alerts

No Suricata Alerts

Suricata TLS

No Suricata TLS

Queries for the computername (1 event)

Time & API	Arguments	Status	Return	Repeated
GetComputerNameA Dec. 22, 2023, 8:08 a.m.	computer_name: TEST22-PC	1	1	0

Checks if process is being debugged by a debugger (1 event)

Time & API	Arguments	Status	Return	Repeated
IsDebuggerPresent Dec. 22, 2023, 8:08 a.m.			0	0

Checks amount of memory in system, this can be used to detect virtual machines that have a low amount of memory available (1 event)

Time & API	Arguments	Status	Return	Repeated
GlobalMemoryStatusEx Dec. 22, 2023, 8:08 a.m.		1	1	0

The executable contains unknown PE section names indicative of a packer (could be a false positive) (3 events)

section	CODE
section	DATA
section	BSS

One or more processes crashed (2 events)

Time & API	Arguments	Status	Return	Repeated
__exception__ Dec. 22, 2023, 8:08 a.m.	stacktrace: adobe+0x40c02 @ 0x440c02 adobe+0x42a47 @ 0x442a47 adobe+0x48110 @ 0x448110 adobe+0x3e015 @ 0x43e015 adobe+0x3cf4b @ 0x43cf4b adobe+0x932f2 @ 0x4932f2 adobe+0x7f324 @ 0x47f324 adobe+0x97216 @ 0x497216 BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x755c33ca RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x76f49ed2 RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x76f49ea5 exception.instruction_r: 8b 06 c7 45 fc fe ff ff ff 85 db 0f 85 97 34 00 exception.symbol: WNetCloseEnum+0x14 WNetOpenEnumW-0x11c mpr+0x2dea exception.instruction: mov eax, dword ptr [esi] exception.module: mpr.dll exception.exception_code: 0xc0000005 exception.offset: 11754 exception.address: 0x74162dea registers.esp: 1637604 registers.edi: 5087204 registers.eax: 1637632 registers.ebp: 1637648 registers.edx: 44 registers.ebx: 0 registers.esi: 44 registers.ecx: 0	1	0	0
__exception__ Dec. 22, 2023, 8:08 a.m.	stacktrace: adobe+0x3db3a @ 0x43db3a adobe+0x3cf4b @ 0x43cf4b adobe+0x932f2 @ 0x4932f2 adobe+0x7f324 @ 0x47f324 adobe+0x97216 @ 0x497216 BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x755c33ca RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x76f49ed2 RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x76f49ea5 exception.instruction_r: f7 37 89 06 e9 dd 07 00 00 8b 06 33 d2 8a 17 8b exception.symbol: adobe+0x3ae2f exception.instruction: div dword ptr [edi] exception.module: adobe.tmp exception.exception_code: 0xc0000094 exception.offset: 241199 exception.address: 0x43ae2f registers.esp: 1637776 registers.edi: 5083072 registers.eax: 7260139 registers.ebp: 1637856 registers.edx: 0 registers.ebx: 1 registers.esi: 5083064 registers.ecx: 5083072	1	0	0

Allocates read-write-execute memory (usually to unpack itself) (6 events)

Time & API	Arguments	Status	Return	Repeated
NtProtectVirtualMemory Dec. 22, 2023, 8:08 a.m.	process_identifier: 2556 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00400000 process_handle: 0xffffffff	1	0	0
NtProtectVirtualMemory Dec. 22, 2023, 8:08 a.m.	process_identifier: 2556 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 40960 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00401000 process_handle: 0xffffffff	1	0	0
NtProtectVirtualMemory Dec. 22, 2023, 8:08 a.m.	process_identifier: 2556 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 20480 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0040f000 process_handle: 0xffffffff	1	0	0
NtProtectVirtualMemory Dec. 22, 2023, 8:08 a.m.	process_identifier: 2556 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x73bc2000 process_handle: 0xffffffff	1	0	0
NtAllocateVirtualMemory Dec. 22, 2023, 8:08 a.m.	process_identifier: 2608 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00350000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1	0	0
NtProtectVirtualMemory Dec. 22, 2023, 8:08 a.m.	process_identifier: 2608 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x73bc2000 process_handle: 0xffffffff	1	0	0

Creates executable files on the filesystem (4 events)

file	C:\Users\test22\AppData\Local\Temp\is-450TU.tmp\_isetup\_isdecmp.dll
file	C:\Program Files (x86)\RButtonTRAY\rbuttontray.exe
file	C:\Users\test22\AppData\Local\Temp\is-450TU.tmp\_isetup\_iscrypt.dll
file	C:\Users\test22\AppData\Local\Temp\is-450TU.tmp\_isetup\_shfoldr.dll

Drops an executable to the user AppData folder (5 events)

file	C:\Users\test22\AppData\Local\Temp\is-BJ47O.tmp\adobe.tmp
file	C:\Users\test22\AppData\Local\Temp\is-450TU.tmp\_isetup\_shfoldr.dll
file	C:\Users\test22\AppData\Local\Temp\is-450TU.tmp\_isetup\_iscrypt.dll
file	C:\Users\test22\AppData\Local\Temp\is-450TU.tmp\_isetup\_isdecmp.dll
file	C:\Users\test22\AppData\Local\Temp\is-450TU.tmp\_isetup\_RegDLL.tmp

Queries for potentially installed applications (4 events)

Time & API	Arguments	Status	Return	Repeated
RegOpenKeyExA Dec. 22, 2023, 8:08 a.m.	regkey_r: Software\Microsoft\Windows\CurrentVersion\Uninstall\RButtonTRAY_is1 base_handle: 0x80000001 key_handle: 0x00000000 options: 0 access: 0x00000001 regkey: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Uninstall\RButtonTRAY_is1		2	0
RegOpenKeyExA Dec. 22, 2023, 8:08 a.m.	regkey_r: Software\Microsoft\Windows\CurrentVersion\Uninstall\RButtonTRAY_is1 base_handle: 0x80000002 key_handle: 0x00000000 options: 0 access: 0x00000001 regkey: HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Uninstall\RButtonTRAY_is1		2	0
RegOpenKeyExA Dec. 22, 2023, 8:08 a.m.	regkey_r: Software\Microsoft\Windows\CurrentVersion\Uninstall\RButtonTRAY_is1 base_handle: 0x80000001 key_handle: 0x00000000 options: 0 access: 0x00000008 regkey: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Uninstall\RButtonTRAY_is1		2	0
RegOpenKeyExA Dec. 22, 2023, 8:08 a.m.	regkey_r: Software\Microsoft\Windows\CurrentVersion\Uninstall\RButtonTRAY_is1 base_handle: 0x80000002 key_handle: 0x00000000 options: 0 access: 0x00000008 regkey: HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Uninstall\RButtonTRAY_is1		2	0