popup
Summary | ZeroBOX
  1. Home
  2. Result
  3. Report
  4. Detail Analysis

getlab.exe

Emotet Gen1 Generic Malware Malicious Library UPX PE64 MZP Format PE File OS Processor Check PE32 DLL
  1. Resubmit sample
Category Machine Started Completed
FILE s1_win7_x6401 Sept. 25, 2024, 10:47 a.m. Sept. 25, 2024, 11:13 a.m.
Size 3.0MB
Type PE32 executable (GUI) Intel 80386, for MS Windows
MD5 78701f8bedb23d81e15ee0c8b7cb826f
SHA256 bb454f3df3e9e0c53d640f502c432fe9703cb0654eae0c04230202f009aafeb0
CRC32 1A3F9F02
ssdeep 49152:C9bzBaJrMDR0iBXqgFa0vveX0X0MrYVL3wHf+44/XeB8P5TEpksoq2CGmjwGZfGj:MbzAJrsCILvZEMrYpe+xX+8P5Tioq2Ci
Yara
  • Malicious_Library_Zero - Malicious_Library
  • PE_Header_Zero - PE File Signature
  • Win32_Trojan_Emotet_2_Zero - Win32 Trojan Emotet
  • IsPE32 - (no description)
  • UPX_Zero - UPX packed file
  • mzp_file_format - MZP(Delphi) file format

Name Response Post-Analysis Lookup
No hosts contacted.
IP Address Status Action
164.124.101.2 Active Moloch

Suricata Alerts

No Suricata Alerts

Suricata TLS

No Suricata TLS

Time & API Arguments Status Return Repeated

GetComputerNameA

 computer_name: TEST22-PC
1 1 0
Time & API Arguments Status Return Repeated

IsDebuggerPresent

 0 0
Time & API Arguments Status Return Repeated

GlobalMemoryStatusEx

 1 1 0
section CODE
section DATA
section BSS
Time & API Arguments Status Return Repeated

__exception__

 stacktrace: 
getlab+0x413ae @ 0x4413ae
getlab+0x431f3 @ 0x4431f3
getlab+0x488bc @ 0x4488bc
getlab+0x3e7c1 @ 0x43e7c1
getlab+0x3d6f7 @ 0x43d6f7
getlab+0x95356 @ 0x495356
getlab+0x8107f @ 0x48107f
getlab+0x9921b @ 0x49921b
BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x755c33ca
RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x76f49ed2
RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x76f49ea5

exception.instruction_r: 8b 06 c7 45 fc fe ff ff ff 85 db 0f 85 97 34 00
exception.symbol: WNetCloseEnum+0x14 WNetOpenEnumW-0x11c mpr+0x2dea
exception.instruction: mov eax, dword ptr [esi]
exception.module: mpr.dll
exception.exception_code: 0xc0000005
exception.offset: 11754
exception.address: 0x74162dea
registers.esp: 1637604
registers.edi: 31039588
registers.eax: 1637632
registers.ebp: 1637648
registers.edx: 924
registers.ebx: 0
registers.esi: 924
registers.ecx: 0
1 0 0

__exception__

 stacktrace: 
getlab+0x413ae @ 0x4413ae
getlab+0x431f3 @ 0x4431f3
getlab+0x488bc @ 0x4488bc
getlab+0x3e7c1 @ 0x43e7c1
getlab+0x3d6f7 @ 0x43d6f7
getlab+0x95356 @ 0x495356
getlab+0x8107f @ 0x48107f
getlab+0x9921b @ 0x49921b
BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x755c33ca
RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x76f49ed2
RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x76f49ea5

exception.instruction_r: 8b 06 c7 45 fc fe ff ff ff 85 db 0f 85 97 34 00
exception.symbol: WNetCloseEnum+0x14 WNetOpenEnumW-0x11c mpr+0x2dea
exception.instruction: mov eax, dword ptr [esi]
exception.module: mpr.dll
exception.exception_code: 0xc0000005
exception.offset: 11754
exception.address: 0x74162dea
registers.esp: 1637604
registers.edi: 31039636
registers.eax: 1637632
registers.ebp: 1637648
registers.edx: 44
registers.ebx: 0
registers.esi: 44
registers.ecx: 0
1 0 0

__exception__

 stacktrace: 
getlab+0x3e2e6 @ 0x43e2e6
getlab+0x3d6f7 @ 0x43d6f7
getlab+0x95356 @ 0x495356
getlab+0x8107f @ 0x48107f
getlab+0x9921b @ 0x49921b
BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x755c33ca
RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x76f49ed2
RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x76f49ea5

exception.instruction_r: f7 37 89 06 e9 dd 07 00 00 8b 06 33 d2 8a 17 8b
exception.symbol: getlab+0x3b5db
exception.instruction: div dword ptr [edi]
exception.module: getlab.tmp
exception.exception_code: 0xc0000094
exception.offset: 243163
exception.address: 0x43b5db
registers.esp: 1637776
registers.edi: 31035580
registers.eax: 13299615
registers.ebp: 1637856
registers.edx: 0
registers.ebx: 1
registers.esi: 31035572
registers.ecx: 31035580
1 0 0
Time & API Arguments Status Return Repeated

NtProtectVirtualMemory

 process_identifier: 2756
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x00400000
process_handle: 0xffffffff
1 0 0

NtProtectVirtualMemory

 process_identifier: 2756
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 40960
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x00401000
process_handle: 0xffffffff
1 0 0

NtProtectVirtualMemory

 process_identifier: 2756
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 20480
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x0040f000
process_handle: 0xffffffff
1 0 0

NtProtectVirtualMemory

 process_identifier: 2756
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x73bc2000
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2852
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x00360000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtProtectVirtualMemory

 process_identifier: 2852
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x73bc2000
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 1452
region_size: 65536
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x0000000004730000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffffffffffff
1 0 0
file C:\Users\test22\AppData\Local\Temp\is-3GC2B.tmp\_isetup\_shfoldr.dll
file C:\Users\test22\AppData\Local\Regei Video Editor\regeivideoeditor3264.exe
file C:\Users\test22\AppData\Local\Temp\is-3GC2B.tmp\_isetup\_iscrypt.dll
file C:\Users\test22\AppData\Local\Temp\is-3GC2B.tmp\_isetup\_shfoldr.dll
file C:\Users\test22\AppData\Local\Temp\is-F93SS.tmp\getlab.tmp
file C:\Users\test22\AppData\Local\Temp\is-3GC2B.tmp\_isetup\_iscrypt.dll
Time & API Arguments Status Return Repeated

RegOpenKeyExA

 regkey_r: Software\Microsoft\Windows\CurrentVersion\Uninstall\Regei Video Editor_is1
base_handle: 0x80000001
key_handle: 0x00000000
options: 0
access: 0x00000001
regkey: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Uninstall\Regei Video Editor_is1
2 0

RegOpenKeyExA

 regkey_r: Software\Microsoft\Windows\CurrentVersion\Uninstall\Regei Video Editor_is1
base_handle: 0x80000002
key_handle: 0x00000000
options: 0
access: 0x00000001
regkey: HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Uninstall\Regei Video Editor_is1
2 0

RegOpenKeyExA

 regkey_r: Software\Microsoft\Windows\CurrentVersion\Uninstall\Regei Video Editor_is1
base_handle: 0x80000001
key_handle: 0x00000000
options: 0
access: 0x00000008
regkey: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Uninstall\Regei Video Editor_is1
2 0

RegOpenKeyExA

 regkey_r: Software\Microsoft\Windows\CurrentVersion\Uninstall\Regei Video Editor_is1
base_handle: 0x80000002
key_handle: 0x00000000
options: 0
access: 0x00000008
regkey: HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Uninstall\Regei Video Editor_is1
2 0
Bkav W32.AIDetectMalware
VIPRE Gen:Heur.Munp.1
CrowdStrike win/grayware_confidence_70% (D)
BitDefender Gen:Heur.Munp.1
Arcabit Trojan.Munp.1
ESET-NOD32 multiple detections
MicroWorld-eScan Gen:Heur.Munp.1
Emsisoft Gen:Heur.Munp.1 (B)
CTX exe.unknown.munp
FireEye Gen:Heur.Munp.1
GData Gen:Heur.Munp.1
Malwarebytes Trojan.Dropper
Ikarus Trojan.Win32.Crypt
huorong HEUR:TrojanDropper/Agent.t