popup
Summary | ZeroBOX
  1. Home
  2. Result
  3. Report
  4. Detail Analysis

wnbsqv3008.exe

Emotet Gen1 Malicious Library UPX PE64 MZP Format PE File OS Processor Check PE32
  1. Resubmit sample
Category Machine Started Completed
FILE s1_win7_x6403_us Aug. 30, 2024, 6:07 p.m. Aug. 30, 2024, 6:13 p.m.
Size 3.3MB
Type PE32 executable (GUI) Intel 80386, for MS Windows
MD5 bc8cacd01aa943fbfbf9880d970c56ab
SHA256 6ab14c6e948ba0df9ae1c257a15f84f206a23726337ff740cd47858237fe1ee7
CRC32 D5C5F8E4
ssdeep 98304:ZykGIDNMRdmuysUxU4LLYy/3mw8xVFR1X:baRdmbsC8xBB
Yara
  • Malicious_Library_Zero - Malicious_Library
  • PE_Header_Zero - PE File Signature
  • Win32_Trojan_Emotet_2_Zero - Win32 Trojan Emotet
  • IsPE32 - (no description)
  • UPX_Zero - UPX packed file
  • mzp_file_format - MZP(Delphi) file format

Name Response Post-Analysis Lookup
No hosts contacted.
IP Address Status Action
No hosts contacted.

Suricata Alerts

No Suricata Alerts

Suricata TLS

No Suricata TLS

Time & API Arguments Status Return Repeated

IsDebuggerPresent

 0 0
section CODE
section DATA
section BSS
Time & API Arguments Status Return Repeated

NtProtectVirtualMemory

 process_identifier: 536
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x00400000
process_handle: 0xffffffff
1 0 0

NtProtectVirtualMemory

 process_identifier: 536
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 45056
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x00401000
process_handle: 0xffffffff
1 0 0

NtProtectVirtualMemory

 process_identifier: 536
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 20480
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x00410000
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2120
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x01e20000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 1236
region_size: 65536
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x0000000004d30000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffffffffffff
1 0 0
file C:\Users\test22\AppData\Local\Temp\is-B84PD.tmp\wnbsqv3008.tmp
Time & API Arguments Status Return Repeated

RegOpenKeyExA

 regkey_r: Software\Microsoft\Windows\CurrentVersion\Uninstall\{6A1673D1-FC08-4b1b-A90B-C1EC6C6496AC}_is1
base_handle: 0x80000001
key_handle: 0x00000000
options: 0
access: 0x00000001
regkey: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Uninstall\{6A1673D1-FC08-4b1b-A90B-C1EC6C6496AC}_is1
2 0

RegOpenKeyExA

 regkey_r: Software\Microsoft\Windows\CurrentVersion\Uninstall\{6A1673D1-FC08-4b1b-A90B-C1EC6C6496AC}_is1
base_handle: 0x80000002
key_handle: 0x00000000
options: 0
access: 0x00000001
regkey: HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Uninstall\{6A1673D1-FC08-4b1b-A90B-C1EC6C6496AC}_is1
2 0
Bkav W32.Common.F7786641
Lionic Trojan.Win32.QQPass.i!c
Skyhigh BehavesLike.Win32.ObfuscatedPoly.wc
McAfee Artemis!BC8CACD01AA9
Cylance Unsafe
Sangfor Infostealer.Win32.QQPass.V4is
VirIT Trojan.Win32.InnoDrp.GZZ
APEX Malicious
Avast Win32:Malware-gen
Kaspersky Trojan-PSW.Win32.QQPass.mljx
Alibaba TrojanPSW:Win32/QQPass.70b3054c
McAfeeD ti!6AB14C6E948B
Google Detected
Kingsoft Win32.Riskware.Gamehack.s
Xcitium Malware@#36cgsdlegeffx
ViRobot Trojan.Win.Z.Agent.3434513
ZoneAlarm Trojan-PSW.Win32.QQPass.mljx
Varist W32/ABTrojan.JDJQ-3249
AhnLab-V3 Unwanted/Win.Agent.C5119250
DeepInstinct MALICIOUS
Tencent Win32.Trojan-QQPass.QQRob.Bkjl
huorong Backdoor/Humpler.h
MaxSecure Trojan.Malware.184646413.susgen
Fortinet W32/PossibleThreat
AVG Win32:Malware-gen
Paloalto generic.ml
CrowdStrike win/malicious_confidence_100% (W)