popup
Summary | ZeroBOX
  1. Home
  2. Result
  3. Report
  4. Detail Analysis

tdrpload.exe

Generic Malware UPX Downloader Admin Tool (Sysinternals etc ...) Malicious Library Malicious Packer PE File PE32
  1. Resubmit sample
Category Machine Started Completed
FILE s1_win7_x6403_us July 16, 2024, 10:57 a.m. July 16, 2024, 10:59 a.m.
Size 88.0KB
Type PE32 executable (GUI) Intel 80386, for MS Windows
MD5 ababca6d12d96e8dd2f1d7114b406fae
SHA256 a992920e64a64763f3dd8c2a431a0f5e56e5b3782a1496de92bc80ee71cca5ba
CRC32 6C526A17
ssdeep 1536:wL0IGzbFmav82XwudP6+0MTqEjXm/D5AKHK:c0poOfP6+JuEjaaKHK
Yara
  • Network_Downloader - File Downloader
  • Malicious_Library_Zero - Malicious_Library
  • Admin_Tool_IN_Zero - Admin Tool Sysinternals
  • PE_Header_Zero - PE File Signature
  • Malicious_Packer_Zero - Malicious Packer
  • IsPE32 - (no description)
  • UPX_Zero - UPX packed file
  • Generic_Malware_Zero - Generic Malware

Name Response Post-Analysis Lookup
www.update.microsoft.com
A 20.72.235.82
CNAME redir.update.msft.com.trafficmanager.net
20.72.235.82
IP Address Status Action
117.236.188.177 Active Moloch
134.35.106.7 Active Moloch
146.70.53.161 Active Moloch
151.234.69.79 Active Moloch
151.235.83.141 Active Moloch
164.124.101.2 Active Moloch
178.217.173.26 Active Moloch
185.215.113.66 Active Moloch
20.72.235.82 Active Moloch
217.30.171.37 Active Moloch
46.248.37.21 Active Moloch
5.233.65.104 Active Moloch
78.106.189.161 Active Moloch
82.137.218.134 Active Moloch
94.183.35.131 Active Moloch
95.59.234.182 Active Moloch

Time & API Arguments Status Return Repeated

IsDebuggerPresent

 0 0
suspicious_features Connection to IP address suspicious_request GET http://185.215.113.66/1
suspicious_features Connection to IP address suspicious_request GET http://185.215.113.66/2
request GET http://185.215.113.66/1
request GET http://185.215.113.66/2
ip 117.236.188.177
ip 146.70.53.161
ip 151.234.69.79
ip 151.235.83.141
ip 178.217.173.26
ip 217.30.171.37
ip 46.248.37.21
ip 5.233.65.104
ip 78.106.189.161
ip 94.183.35.131
ip 95.59.234.182
description sysmablsvr.exe tried to sleep 190 seconds, actually delayed analysis time by 190 seconds
file C:\Users\test22\AppData\Local\Temp\1095022896.exe
Time & API Arguments Status Return Repeated

NtCreateFile

 create_disposition: 5 (FILE_OVERWRITE_IF)
file_handle: 0x00000374
filepath: C:\Users\test22\tbtnds.dat
desired_access: 0x40100080 (FILE_READ_ATTRIBUTES|SYNCHRONIZE|GENERIC_WRITE)
file_attributes: 2 (FILE_ATTRIBUTE_HIDDEN)
filepath_r: \??\C:\Users\test22\tbtnds.dat
create_options: 96 (FILE_NON_DIRECTORY_FILE|FILE_SYNCHRONOUS_IO_NONALERT)
status_info: 2 (FILE_CREATED)
share_access: 0 ()
1 0 0
host 117.236.188.177
host 134.35.106.7
host 146.70.53.161
host 151.234.69.79
host 151.235.83.141
host 178.217.173.26
host 185.215.113.66
host 217.30.171.37
host 46.248.37.21
host 5.233.65.104
host 78.106.189.161
host 82.137.218.134
host 94.183.35.131
host 95.59.234.182
reg_key HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\Windows Settings reg_value C:\Windows\sysmablsvr.exe
registry HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU\NoAutoUpdate
registry HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UpdatesOverride
registry HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiSpywareOverride
registry HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UpdatesDisableNotify
registry HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusOverride
registry HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallDisableNotify
registry HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusDisableNotify
registry HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallOverride
file C:\Users\test22\AppData\Local\Temp\tdrpload.exe:Zone.Identifier
file C:\Windows\sysmablsvr.exe:Zone.Identifier
file C:\Users\test22\AppData\Local\Temp\1095022896.exe:Zone.Identifier
description attempts to disable antivirus notifications registry HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusOverride
description attempts to disable antivirus notifications registry HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusDisableNotify
description attempts to disable firewall notifications registry HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallDisableNotify
description attempts to disable firewall notifications registry HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallOverride
description attempts to disable windows update notifications registry HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UpdatesDisableNotify
service wuauserv (regkey HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\wuauserv\Start)
service BITS (regkey HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\BITS\Start)
Bkav W32.BeeyWcsjvulF.Trojan
Lionic Trojan.Win32.Phorpiex.4!c
Cynet Malicious (score: 100)
CAT-QuickHeal Trojan.Multi
Cylance Unsafe
VIPRE Gen:Heur.Mint.Zard.39
Sangfor Trojan.Win32.Save.a
K7AntiVirus Trojan ( 005533551 )
K7GW Trojan ( 005533551 )
Cybereason malicious.d12d96
VirIT Trojan.Win32.Genus.VXH
Symantec ML.Attribute.HighConfidence
Elastic malicious (high confidence)
ESET-NOD32 a variant of Win32/Phorpiex.V
APEX Malicious
Paloalto generic.ml
ClamAV Win.Trojan.Phorpiex-10030343-0
Alibaba Worm:Win32/Phorpiex.5c685c46
NANO-Antivirus Trojan.Win32.Phorpiex.koniga
MicroWorld-eScan Gen:Heur.Mint.Zard.39
Rising Worm.Phorpiex!8.48D (TFE:3:2wXnuqqcioP)
Emsisoft Gen:Heur.Mint.Zard.39 (B)
F-Secure Heuristic.HEUR/AGEN.1366496
DrWeb Trojan.DownLoader46.2135
BitDefenderTheta AI:Packer.46E3DD1D1E
McAfeeD Real Protect-LS!ABABCA6D12D9
Trapmine malicious.high.ml.score
FireEye Generic.mg.ababca6d12d96e8d
Sophos W32/Trizt-Gen
Ikarus Trojan.Win32.Phorpiex
Webroot W32.Trojan.Gen
Avira HEUR/AGEN.1366496
MAX malware (ai score=82)
Antiy-AVL Trojan/Win32.Phorpiex
Kingsoft malware.kb.a.1000
Gridinsoft Trojan.Win32.Downloader.sa
Xcitium Malware@#2w9v0gjci7x32
ZoneAlarm UDS:DangerousObject.Multi.Generic
Google Detected
AhnLab-V3 Trojan/Win.Generic.C4630408
VBA32 BScope.Worm.Propriex
DeepInstinct MALICIOUS
Malwarebytes Phorpiex.Trojan.Bot.DDS
TrendMicro-HouseCall TROJ_GEN.R06CC0DFC24
Tencent Malware.Win32.Gencirc.10c01086
Yandex Trojan.Agent!d7bZodg/Ml0
SentinelOne Static AI - Malicious PE
Fortinet W32/Malicious_Behavior.SBX
Panda Adware/SecurityProtection
CrowdStrike win/malicious_confidence_100% (D)
dead_host 82.137.218.134:40500
dead_host 134.35.106.7:40500