popup
Summary | ZeroBOX
  1. Home
  2. Result
  3. Report
  4. Detail Analysis

Solara.exe

Emotet Gen1 Malicious Library UPX AntiDebug PE64 PE File CAB AntiVM
  1. Resubmit sample
Category Machine Started Completed
FILE s1_win7_x6401 Sept. 26, 2024, 9:47 a.m. Sept. 26, 2024, 9:49 a.m.
Size 161.5KB
Type PE32+ executable (GUI) x86-64, for MS Windows
MD5 51c009abf871216f8d9e40cdd785ce6c
SHA256 9754bc10564077425803459cc91b0197ad96263e6994e9afc2a5fd0e932615d8
CRC32 E44EB212
ssdeep 3072:xahKyd2n31q5GWp1icKAArDZz4N9GhbkrNEk11/cWQKCT:xahO6p0yN90QEoBS
PDB Path wextract.pdb
Yara
  • Malicious_Library_Zero - Malicious_Library
  • PE_Header_Zero - PE File Signature
  • IsPE64 - (no description)
  • Win32_Trojan_Emotet_RL_Gen_Zero - Win32 Trojan Emotet
  • CAB_file_format - CAB archive file
  • Win32_Trojan_Gen_1_0904B0_Zero - Win32 Trojan Emotet
  • UPX_Zero - UPX packed file

Name Response Post-Analysis Lookup
No hosts contacted.
IP Address Status Action
No hosts contacted.

Suricata Alerts

No Suricata Alerts

Suricata TLS

No Suricata TLS

Time & API Arguments Status Return Repeated

GetComputerNameW

 computer_name: TEST22-PC
1 1 0
Time & API Arguments Status Return Repeated

IsDebuggerPresent

 0 0
registry HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\MachineGuid
pdb_path wextract.pdb
Time & API Arguments Status Return Repeated

GlobalMemoryStatusEx

 1 1 0
resource name AVI
Time & API Arguments Status Return Repeated

NtProtectVirtualMemory

 process_identifier: 2544
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x000000007304c000
process_handle: 0xffffffffffffffff
1 0 0

NtProtectVirtualMemory

 process_identifier: 2776
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x000000007304c000
process_handle: 0xffffffffffffffff
1 0 0
file C:\Users\test22\AppData\Local\Temp\IXP000.TMP\fqt.vbs
cmdline cmd.exe /c fqt.vbs
section {u'size_of_data': u'0x0001d600', u'virtual_address': u'0x0000f000', u'entropy': 7.0685837986114635, u'name': u'.rsrc', u'virtual_size': u'0x0001e000'} entropy 7.06858379861 description A section with a high entropy has been found
entropy 0.732087227414 description Overall entropy of this PE file is high
description (no description) rule DebuggerCheck__GlobalFlags
description (no description) rule DebuggerCheck__QueryInfo
description (no description) rule DebuggerHiding__Thread
description (no description) rule DebuggerHiding__Active
description (no description) rule ThreadControl__Context
description (no description) rule SEH__vectored
description Checks if being debugged rule anti_dbg
description Bypass DEP rule disable_dep
reg_key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 reg_value rundll32.exe C:\Windows\system32\advpack.dll,DelNodeRunDLL32 "C:\Users\test22\AppData\Local\Temp\IXP000.TMP\"
file C:\Users\test22\AppData\Local\Temp\IXP000.TMP\fqt.vbs
Bkav W64.AIDetectMalware
Skyhigh BehavesLike.Win64.Downloader.ch
Cylance Unsafe
Elastic malicious (high confidence)
APEX Malicious
Kaspersky HEUR:Trojan.Script.Generic
Rising Trojan.Obfus/JS!1.10268 (CLASSIC)
Google Detected
Microsoft Program:Win32/Wacapew.C!ml
Varist W64/Agent.GIK.gen!Eldorado
DeepInstinct MALICIOUS
huorong Trojan/VBS.GuLoader.ar
MaxSecure Trojan.Malware.300983.susgen
Process injection Process 2656 resumed a thread in remote process 2776
Time & API Arguments Status Return Repeated

NtResumeThread

 thread_handle: 0x0000000000000288
suspend_count: 1
process_identifier: 2776
1 0 0