Summary | ZeroBOX

Category	Machine	Started	Completed
FILE	s1_win7_x6403_us	Sept. 19, 2024, 11:16 a.m.	Sept. 19, 2024, 11:21 a.m.

Size	127.5KB
Type	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
MD5	`d9dd7aedaae6adb2c1156aacacf87147`
SHA256	`9cfcdabfffa205793ef546b2d774d8a5048d4c9b3f72ec7e9f660111c95441c1`
CRC32	`97B776C6`
ssdeep	`3072:9DrG/eLj+t+YpqUjWouVPkrH3/U9avw62xm4+5j:BaeL6g2jfuVPquA5j`
Yara	Win_Amadey_Zero - Amadey bot Malicious_Library_Zero - Malicious_Library PE_Header_Zero - PE File Signature IsDLL - (no description) IsPE32 - (no description) Generic_Malware_Zero - Generic Malware UPX_Zero - UPX packed file OS_Processor_Check_Zero - OS Processor Check

rundll32.exe "C:\Windows\System32\rundll32.exe" C:\Users\test22\AppData\Local\Temp\clip64.dll,??4CClipperDLL@@QAEAAV0@$$QAV0@@Z
1208
rundll32.exe "C:\Windows\System32\rundll32.exe" C:\Users\test22\AppData\Local\Temp\clip64.dll,??4CClipperDLL@@QAEAAV0@ABV0@@Z
2140
rundll32.exe "C:\Windows\System32\rundll32.exe" C:\Users\test22\AppData\Local\Temp\clip64.dll,Main
2240
rundll32.exe "C:\Windows\System32\rundll32.exe" C:\Users\test22\AppData\Local\Temp\clip64.dll,
2328

Name	Response	Post-Analysis Lookup
No hosts contacted.

IP Address	Status	Action
5.181.86.244	Active	Moloch

Suricata Alerts

No Suricata Alerts

Suricata TLS

No Suricata TLS

Checks if process is being debugged by a debugger (3 events)

Time & API	Arguments	Status	Return	Repeated
IsDebuggerPresent Sept. 19, 2024, 11:16 a.m.			0	0
IsDebuggerPresent Sept. 19, 2024, 11:16 a.m.			0	0
IsDebuggerPresent Sept. 19, 2024, 11:16 a.m.			0	0

HTTP traffic contains suspicious features which may be indicative of malware related traffic (1 event)

suspicious_features

POST method with no referer header, POST method with no useragent header, Connection to IP address

suspicious_request

POST http://5.181.86.244/aXfj40bOe4/index.php

Performs some HTTP requests (1 event)

request

POST http://5.181.86.244/aXfj40bOe4/index.php

Sends data using the HTTP POST Method (1 event)

request

POST http://5.181.86.244/aXfj40bOe4/index.php

Allocates read-write-execute memory (usually to unpack itself) (18 events)

Time & API	Arguments	Status
NtProtectVirtualMemory Sept. 19, 2024, 11:16 a.m.	process_identifier: 1208 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x744c7000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Sept. 19, 2024, 11:16 a.m.	process_identifier: 1208 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x75931000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Sept. 19, 2024, 11:16 a.m.	process_identifier: 1208 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x76e01000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Sept. 19, 2024, 11:16 a.m.	process_identifier: 1208 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x752e1000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Sept. 19, 2024, 11:16 a.m.	process_identifier: 1208 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x74440000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Sept. 19, 2024, 11:16 a.m.	process_identifier: 1208 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x744f1000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Sept. 19, 2024, 11:16 a.m.	process_identifier: 2140 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x744c7000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Sept. 19, 2024, 11:16 a.m.	process_identifier: 2140 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x75931000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Sept. 19, 2024, 11:16 a.m.	process_identifier: 2140 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x76e01000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Sept. 19, 2024, 11:16 a.m.	process_identifier: 2140 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x752e1000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Sept. 19, 2024, 11:16 a.m.	process_identifier: 2140 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x74440000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Sept. 19, 2024, 11:16 a.m.	process_identifier: 2140 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x744f1000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Sept. 19, 2024, 11:16 a.m.	process_identifier: 2240 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x744c7000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Sept. 19, 2024, 11:16 a.m.	process_identifier: 2240 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x75931000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Sept. 19, 2024, 11:16 a.m.	process_identifier: 2240 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x76e01000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Sept. 19, 2024, 11:16 a.m.	process_identifier: 2240 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x752e1000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Sept. 19, 2024, 11:16 a.m.	process_identifier: 2240 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x74440000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Sept. 19, 2024, 11:16 a.m.	process_identifier: 2240 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x744f1000 process_handle: 0xffffffff	1

Communicates with host for which no DNS query was performed (1 event)

host

5.181.86.244

File has been identified by 41 AntiVirus engines on VirusTotal as malicious (41 events)

Bkav	W32.AIDetectMalware
Lionic	Trojan.Win32.ClipBanker.Z!c
Cynet	Malicious (score: 100)
CTX	dll.trojan.clipbanker
Cylance	Unsafe
Sangfor	Banker.Win32.Clipbanker.Vttt
CrowdStrike	win/malicious_confidence_90% (D)
K7GW	Trojan ( 005b15cb1 )
K7AntiVirus	Trojan ( 005b15cb1 )
Symantec	ML.Attribute.HighConfidence
Elastic	malicious (high confidence)
Paloalto	generic.ml
ClamAV	Win.Malware.Zusy-10015683-0
Alibaba	Trojan:Win32/Amadey.9f63caf2
NANO-Antivirus	Trojan.Win32.SpyBot.kpzgmh
MicroWorld-eScan	Gen:Variant.Zusy.446682
Rising	Trojan.ClipBanker!8.5FB (TFE:5:nquGHEI3J2D)
Emsisoft	Gen:Variant.Zusy.446682 (B)
F-Secure	Trojan.TR/ClipBanker.hcszu
DrWeb	Trojan.SpyBot.1461
Zillya	Trojan.ClipBanker.Win32.21634
McAfeeD	ti!9CFCDABFFFA2
Sophos	Mal/Generic-S
Jiangmin	Trojan.Agent.extk
Avira	TR/ClipBanker.hcszu
Antiy-AVL	Trojan/Win32.Amadey
Kingsoft	Win32.Trojan.Agent.gen
Gridinsoft	Ransom.Win32.Banker.sa
Arcabit	Trojan.Zusy.D6D0DA
ZoneAlarm	HEUR:Trojan.Win32.Agent.gen
Microsoft	Trojan:Win32/Amadey.MA!MTB
AhnLab-V3	Trojan/Win.Amadey.C5582822
Malwarebytes	Trojan.ClipBanker
Ikarus	Trojan.Win32.Clipbanker
TrendMicro-HouseCall	TROJ_GEN.R002C0DIA24
Tencent	Malware.Win32.Gencirc.11c68ee3
Yandex	Trojan.Agent!XB3szFjprsQ
huorong	TrojanSpy/ClipBanker.y
Fortinet	W32/ClipBanker.SJ!tr
DeepInstinct	MALICIOUS
alibabacloud	Trojan:Win/ClipBanker.SG

clip64.dll

Process Tree Toggle all

Network Toggle all

Suricata Toggle all

Suricata Alerts

Suricata TLS

Signatures Toggle All