popup
Summary | ZeroBOX
  1. Home
  2. Result
  3. Report
  4. Detail Analysis

noode.exe

Emotet Gen1 Malicious Library UPX PE64 MZP Format PE File OS Processor Check PE32 DLL
  1. Resubmit sample
Category Machine Started Completed
FILE s1_win7_x6401 Sept. 21, 2024, 1:50 p.m. Sept. 21, 2024, 1:52 p.m.
Size 3.4MB
Type PE32 executable (GUI) Intel 80386, for MS Windows
MD5 38f41466d936e5e4edc1eaae88f698cd
SHA256 f0d2d7046c0fe6c450cc80447ac8e4129f2140d7cef3cce80fd376f25820416e
CRC32 416E7B19
ssdeep 98304:MxGEBUKdyndyEDWEWqfeXY5jEETBdlM26rbT44T9viOSyu:EGiUqynOEhaETBn2rH4oviOs
Yara
  • Malicious_Library_Zero - Malicious_Library
  • PE_Header_Zero - PE File Signature
  • Win32_Trojan_Emotet_2_Zero - Win32 Trojan Emotet
  • IsPE32 - (no description)
  • UPX_Zero - UPX packed file
  • mzp_file_format - MZP(Delphi) file format

Name Response Post-Analysis Lookup
No hosts contacted.
IP Address Status Action
No hosts contacted.

Suricata Alerts

No Suricata Alerts

Suricata TLS

No Suricata TLS

Time & API Arguments Status Return Repeated

IsDebuggerPresent

 0 0
Time & API Arguments Status Return Repeated

GlobalMemoryStatusEx

 1 1 0
section CODE
section DATA
section BSS
Time & API Arguments Status Return Repeated

NtProtectVirtualMemory

 process_identifier: 2544
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x00400000
process_handle: 0xffffffff
1 0 0

NtProtectVirtualMemory

 process_identifier: 2544
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 40960
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x00401000
process_handle: 0xffffffff
1 0 0

NtProtectVirtualMemory

 process_identifier: 2544
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 20480
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x0040f000
process_handle: 0xffffffff
1 0 0

NtProtectVirtualMemory

 process_identifier: 2544
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x73bc2000
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2604
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x00360000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtProtectVirtualMemory

 process_identifier: 2604
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x73bc2000
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 1452
region_size: 65536
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x0000000002a50000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffffffffffff
1 0 0
file C:\Users\test22\AppData\Local\Temp\is-GSBA6.tmp\_isetup\_iscrypt.dll
file C:\Users\test22\AppData\Local\Temp\is-GSBA6.tmp\_isetup\_shfoldr.dll
file C:\Users\test22\AppData\Local\Temp\is-GSBA6.tmp\_isetup\_isdecmp.dll
file C:\Users\test22\AppData\Local\Temp\is-GSBA6.tmp\_isetup\_isdecmp.dll
file C:\Users\test22\AppData\Local\Temp\is-946G6.tmp\noode.tmp
file C:\Users\test22\AppData\Local\Temp\is-GSBA6.tmp\_isetup\_shfoldr.dll
file C:\Users\test22\AppData\Local\Temp\is-GSBA6.tmp\_isetup\_iscrypt.dll
Bkav W32.AIDetectMalware
MicroWorld-eScan Gen:Heur.Munp.1
CrowdStrike win/grayware_confidence_70% (D)
BitDefender Gen:Heur.Munp.1
Arcabit Trojan.Munp.1
ESET-NOD32 a variant of Win32/TrojanDropper.Agent.SLC
Avast FileRepMalware [Adw]
Emsisoft Gen:Heur.Munp.1 (B)
Trapmine malicious.moderate.ml.score
CTX exe.unknown.munp
FireEye Gen:Heur.Munp.1
Kingsoft Win32.Troj.Agent.cks
Microsoft Trojan:Win32/Sabsik.TE.B!ml
GData Gen:Heur.Munp.1
Ikarus Trojan.Win32.Crypt
huorong HEUR:TrojanDropper/Agent.t
AVG FileRepMalware [Adw]
Paloalto generic.ml