Summary | ZeroBOX

Category	Machine	Started	Completed
FILE	s1_win7_x6401	July 16, 2024, 1:57 p.m.	July 16, 2024, 1:59 p.m.

Size	127.5KB
Type	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
MD5	`8cfd7419f24c7904d2a71b5ae6ea5daa`
SHA256	`98972d73a823165a52ed8ce9d295250be083884d142c92c3268936c5269fac70`
CRC32	`09B1AC99`
ssdeep	`3072:IDrG/eLj+t+YpqUjWouVPkrH3/U9aQw62xm4+5j:CaeL6g2jfuVPqtA5j`
Yara	Malicious_Library_Zero - Malicious_Library PE_Header_Zero - PE File Signature IsDLL - (no description) Win_Amadey_Zero - Amadey bot IsPE32 - (no description) UPX_Zero - UPX packed file Generic_Malware_Zero - Generic Malware OS_Processor_Check_Zero - OS Processor Check

rundll32.exe "C:\Windows\System32\rundll32.exe" C:\Users\test22\AppData\Local\Temp\clip64.dll,??4CClipperDLL@@QAEAAV0@ABV0@@Z
2640
rundll32.exe "C:\Windows\System32\rundll32.exe" C:\Users\test22\AppData\Local\Temp\clip64.dll,??4CClipperDLL@@QAEAAV0@$$QAV0@@Z
2556
rundll32.exe "C:\Windows\System32\rundll32.exe" C:\Users\test22\AppData\Local\Temp\clip64.dll,Main
2732
rundll32.exe "C:\Windows\System32\rundll32.exe" C:\Users\test22\AppData\Local\Temp\clip64.dll,
2820

Name	Response	Post-Analysis Lookup
No hosts contacted.

IP Address	Status	Action
185.196.8.126	Active	Moloch

Suricata Alerts

No Suricata Alerts

Suricata TLS

No Suricata TLS

Checks if process is being debugged by a debugger (3 events)

Time & API	Arguments	Status	Return	Repeated
IsDebuggerPresent July 16, 2024, 1:57 p.m.			0	0
IsDebuggerPresent July 16, 2024, 1:57 p.m.			0	0
IsDebuggerPresent July 16, 2024, 1:57 p.m.			0	0

HTTP traffic contains suspicious features which may be indicative of malware related traffic (1 event)

suspicious_features

POST method with no referer header, POST method with no useragent header, Connection to IP address

suspicious_request

POST http://185.196.8.126/h9fmdW7/index.php

Performs some HTTP requests (1 event)

request

POST http://185.196.8.126/h9fmdW7/index.php

Sends data using the HTTP POST Method (1 event)

request

POST http://185.196.8.126/h9fmdW7/index.php

Allocates read-write-execute memory (usually to unpack itself) (30 events)

Time & API	Arguments	Status
NtProtectVirtualMemory July 16, 2024, 1:57 p.m.	process_identifier: 2556 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x73be7000 process_handle: 0xffffffff	1
NtProtectVirtualMemory July 16, 2024, 1:57 p.m.	process_identifier: 2556 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x75d41000 process_handle: 0xffffffff	1
NtProtectVirtualMemory July 16, 2024, 1:57 p.m.	process_identifier: 2556 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x75e61000 process_handle: 0xffffffff	1
NtProtectVirtualMemory July 16, 2024, 1:57 p.m.	process_identifier: 2556 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x76161000 process_handle: 0xffffffff	1
NtProtectVirtualMemory July 16, 2024, 1:57 p.m.	process_identifier: 2556 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x73660000 process_handle: 0xffffffff	1
NtProtectVirtualMemory July 16, 2024, 1:57 p.m.	process_identifier: 2556 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x73571000 process_handle: 0xffffffff	1
NtProtectVirtualMemory July 16, 2024, 1:57 p.m.	process_identifier: 2556 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x734e1000 process_handle: 0xffffffff	1
NtProtectVirtualMemory July 16, 2024, 1:57 p.m.	process_identifier: 2556 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x734a4000 process_handle: 0xffffffff	1
NtProtectVirtualMemory July 16, 2024, 1:57 p.m.	process_identifier: 2556 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x73572000 process_handle: 0xffffffff	1
NtProtectVirtualMemory July 16, 2024, 1:57 p.m.	process_identifier: 2556 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x73c11000 process_handle: 0xffffffff	1
NtProtectVirtualMemory July 16, 2024, 1:57 p.m.	process_identifier: 2640 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x73be7000 process_handle: 0xffffffff	1
NtProtectVirtualMemory July 16, 2024, 1:57 p.m.	process_identifier: 2640 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x75d41000 process_handle: 0xffffffff	1
NtProtectVirtualMemory July 16, 2024, 1:57 p.m.	process_identifier: 2640 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x75e61000 process_handle: 0xffffffff	1
NtProtectVirtualMemory July 16, 2024, 1:57 p.m.	process_identifier: 2640 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x76161000 process_handle: 0xffffffff	1
NtProtectVirtualMemory July 16, 2024, 1:57 p.m.	process_identifier: 2640 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x73660000 process_handle: 0xffffffff	1
NtProtectVirtualMemory July 16, 2024, 1:57 p.m.	process_identifier: 2640 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x73571000 process_handle: 0xffffffff	1
NtProtectVirtualMemory July 16, 2024, 1:57 p.m.	process_identifier: 2640 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x734e1000 process_handle: 0xffffffff	1
NtProtectVirtualMemory July 16, 2024, 1:57 p.m.	process_identifier: 2640 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x734a4000 process_handle: 0xffffffff	1
NtProtectVirtualMemory July 16, 2024, 1:57 p.m.	process_identifier: 2640 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x73572000 process_handle: 0xffffffff	1
NtProtectVirtualMemory July 16, 2024, 1:57 p.m.	process_identifier: 2640 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x73c11000 process_handle: 0xffffffff	1
NtProtectVirtualMemory July 16, 2024, 1:57 p.m.	process_identifier: 2732 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x73be7000 process_handle: 0xffffffff	1
NtProtectVirtualMemory July 16, 2024, 1:57 p.m.	process_identifier: 2732 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x75d41000 process_handle: 0xffffffff	1
NtProtectVirtualMemory July 16, 2024, 1:57 p.m.	process_identifier: 2732 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x75e61000 process_handle: 0xffffffff	1
NtProtectVirtualMemory July 16, 2024, 1:57 p.m.	process_identifier: 2732 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x76161000 process_handle: 0xffffffff	1
NtProtectVirtualMemory July 16, 2024, 1:57 p.m.	process_identifier: 2732 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x73660000 process_handle: 0xffffffff	1
NtProtectVirtualMemory July 16, 2024, 1:57 p.m.	process_identifier: 2732 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x73571000 process_handle: 0xffffffff	1
NtProtectVirtualMemory July 16, 2024, 1:57 p.m.	process_identifier: 2732 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x734e1000 process_handle: 0xffffffff	1
NtProtectVirtualMemory July 16, 2024, 1:57 p.m.	process_identifier: 2732 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x734a4000 process_handle: 0xffffffff	1
NtProtectVirtualMemory July 16, 2024, 1:57 p.m.	process_identifier: 2732 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x73572000 process_handle: 0xffffffff	1
NtProtectVirtualMemory July 16, 2024, 1:57 p.m.	process_identifier: 2732 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x73c11000 process_handle: 0xffffffff	1

Communicates with host for which no DNS query was performed (1 event)

host

185.196.8.126

File has been identified by 49 AntiVirus engines on VirusTotal as malicious (49 events)

Bkav	W32.AIDetectMalware
Lionic	Trojan.Win32.ClipBanker.Z!c
Elastic	malicious (high confidence)
Cynet	Malicious (score: 100)
CAT-QuickHeal	Trojan.Amadey
Skyhigh	BehavesLike.Win32.NetLoader.ch
ALYac	Gen:Variant.Zusy.446682
Cylance	Unsafe
VIPRE	Gen:Variant.Zusy.446682
Sangfor	Banker.Win32.Clipbanker.Vj7l
K7AntiVirus	Trojan ( 005b155f1 )
BitDefender	Gen:Variant.Zusy.446682
K7GW	Trojan ( 005b155f1 )
Arcabit	Trojan.Zusy.D6D0DA
Symantec	ML.Attribute.HighConfidence
ESET-NOD32	a variant of Win32/ClipBanker.SJ
McAfee	Trojan.Win32.Amadey.FEC3
Avast	Win32:MalwareX-gen [Trj]
ClamAV	Win.Malware.Zusy-10015683-0
Kaspersky	HEUR:Trojan.Win32.Agent.gen
Alibaba	Trojan:Win32/Amadey.e7e6010a
MicroWorld-eScan	Gen:Variant.Zusy.446682
Rising	Trojan.ClipBanker!8.5FB (TFE:5:nquGHEI3J2D)
Emsisoft	Gen:Variant.Zusy.446682 (B)
F-Secure	Trojan.TR/ClipBanker.bcosf
McAfeeD	ti!98972D73A823
FireEye	Gen:Variant.Zusy.446682
Sophos	Mal/Generic-S
Ikarus	Trojan.Win32.Clipbanker
Google	Detected
Avira	TR/ClipBanker.bcosf
MAX	malware (ai score=84)
Antiy-AVL	Trojan/Win32.ClipBanker
Kingsoft	Win32.Trojan.Agent.gen
Gridinsoft	Ransom.Win32.Banker.sa
Microsoft	Trojan:Win32/Amadey.MA!MTB
ZoneAlarm	HEUR:Trojan.Win32.Agent.gen
GData	Gen:Variant.Zusy.446682
AhnLab-V3	Trojan/Win.Amadey.C5582822
BitDefenderTheta	Gen:NN.ZedlaF.36808.hu4@aurKL1ei
DeepInstinct	MALICIOUS
Malwarebytes	Trojan.ClipBanker
Panda	Trj/GdSda.A
TrendMicro-HouseCall	TROJ_GEN.R049H01GE24
Fortinet	W32/ClipBanker.SJ!tr
AVG	Win32:MalwareX-gen [Trj]
Paloalto	generic.ml
CrowdStrike	win/malicious_confidence_70% (D)
alibabacloud	Trojan:Win/ClipBanker.SG

clip64.dll

Process Tree Toggle all

Network Toggle all

Suricata Toggle all

Suricata Alerts

Suricata TLS

Signatures Toggle All