popup
Summary | ZeroBOX
  1. Home
  2. Result
  3. Report
  4. Detail Analysis

win11.exe

Gen1 Generic Malware Malicious Library UPX MZP Format PE File PE32 JPEG Format DLL
  1. Resubmit sample
Category Machine Started Completed
FILE s1_win7_x6403_us Sept. 26, 2024, 9:49 a.m. Sept. 26, 2024, 10:03 a.m.
Size 861.5KB
Type PE32 executable (GUI) Intel 80386, for MS Windows
MD5 613d958a64df2e883b11d994f57b1c80
SHA256 e9c81976f8630136adcfe16fbee915f12db8795a6c159d13d5c2ed8c0c5b6de0
CRC32 EC8E8AFA
ssdeep 12288:RMSApJVYG5lDLyjsb0eOzkv4R7QnvUUilQ35+6G75V9od+k13Ljj:RnsJ39LyjbJkQFMhmC+6GD9u+I7/
Yara
  • Malicious_Library_Zero - Malicious_Library
  • PE_Header_Zero - PE File Signature
  • Win32_Trojan_Gen_1_0904B0_Zero - Win32 Trojan Emotet
  • IsPE32 - (no description)
  • Generic_Malware_Zero - Generic Malware
  • UPX_Zero - UPX packed file
  • mzp_file_format - MZP(Delphi) file format

Name Response Post-Analysis Lookup
docs.google.com
A 142.250.199.110
172.217.25.174
xred.mooo.com
drive.usercontent.google.com
A 142.250.197.97
142.250.206.193
www.dropbox.com
CNAME www-env.dropbox-dns.com
A 162.125.84.18
162.125.84.18
freedns.afraid.org
A 69.42.215.252
69.42.215.252
IP Address Status Action
142.250.197.97 Active Moloch
142.250.199.110 Active Moloch
162.125.84.18 Active Moloch
164.124.101.2 Active Moloch
38.147.172.248 Active Moloch
69.42.215.252 Active Moloch

Suricata Alerts

Flow SID Signature Category
UDP 192.168.56.103:52760 -> 164.124.101.2:53 2015633 ET INFO DYNAMIC_DNS Query to Abused Domain *.mooo.com Misc activity
TCP 192.168.56.103:49174 -> 162.125.84.18:443 906200054 SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) undefined
TCP 192.168.56.103:49172 -> 142.250.197.97:443 906200054 SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) undefined
TCP 192.168.56.103:49173 -> 162.125.84.18:443 906200054 SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) undefined
TCP 192.168.56.103:49171 -> 142.250.199.110:443 906200054 SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) undefined

Suricata TLS

Flow Issuer Subject Fingerprint
TLSv1
192.168.56.103:49172
142.250.197.97:443 		C=US, O=Google Trust Services, CN=WR2 CN=*.usercontent.google.com f5:54:6d:c6:4a:e9:8d:11:08:42:db:d8:ab:93:c6:b2:fc:80:da:78
TLSv1
192.168.56.103:49171
142.250.199.110:443 		C=US, O=Google Trust Services, CN=WR2 CN=*.google.com 99:1a:e6:c6:9b:04:87:74:e3:da:97:c8:29:09:15:16:cf:1f:6a:78

Time & API Arguments Status Return Repeated

GetComputerNameA

 computer_name: TEST22-PC
1 1 0
Time & API Arguments Status Return Repeated

GlobalMemoryStatusEx

 1 1 0
section CODE
section DATA
section BSS
packer BobSoft Mini Delphi -> BoB / BobSoft
Time & API Arguments Status Return Repeated

__exception__

 stacktrace: 
synaptics+0x7bda4 @ 0x47bda4
synaptics+0x7bcf2 @ 0x47bcf2
synaptics+0x7bcb3 @ 0x47bcb3
synaptics+0x845fd @ 0x4845fd
synaptics+0x959fc @ 0x4959fc
BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x757f33ca
RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x778d9ed2
RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x778d9ea5

exception.instruction_r: c9 c2 10 00 cc cc cc cc cc 8b ff 55 8b ec 56 8b
exception.symbol: RaiseException+0x58 CloseHandle-0x9 kernelbase+0xb727
exception.instruction: leave
exception.module: KERNELBASE.dll
exception.exception_code: 0xeedfade
exception.offset: 46887
exception.address: 0x7559b727
registers.esp: 53870044
registers.edi: 53870232
registers.eax: 53870044
registers.ebp: 53870124
registers.edx: 0
registers.ebx: 4703484
registers.esi: 11001
registers.ecx: 7
1 0 0

__exception__

 stacktrace: 
synaptics+0x7bda4 @ 0x47bda4
synaptics+0x7bcf2 @ 0x47bcf2
synaptics+0x7bcb3 @ 0x47bcb3
synaptics+0x845fd @ 0x4845fd
synaptics+0x95a83 @ 0x495a83
BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x757f33ca
RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x778d9ed2
RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x778d9ea5

exception.instruction_r: c9 c2 10 00 cc cc cc cc cc 8b ff 55 8b ec 56 8b
exception.symbol: RaiseException+0x58 CloseHandle-0x9 kernelbase+0xb727
exception.instruction: leave
exception.module: KERNELBASE.dll
exception.exception_code: 0xeedfade
exception.offset: 46887
exception.address: 0x7559b727
registers.esp: 53867856
registers.edi: 53868044
registers.eax: 53867856
registers.ebp: 53867936
registers.edx: 0
registers.ebx: 4703484
registers.esi: 11004
registers.ecx: 7
1 0 0

__exception__

 stacktrace: 
synaptics+0x7bda4 @ 0x47bda4
synaptics+0x7bcf2 @ 0x47bcf2
synaptics+0x7bcb3 @ 0x47bcb3
synaptics+0x845fd @ 0x4845fd
synaptics+0x95b0a @ 0x495b0a
BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x757f33ca
RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x778d9ed2
RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x778d9ea5

exception.instruction_r: c9 c2 10 00 cc cc cc cc cc 8b ff 55 8b ec 56 8b
exception.symbol: RaiseException+0x58 CloseHandle-0x9 kernelbase+0xb727
exception.instruction: leave
exception.module: KERNELBASE.dll
exception.exception_code: 0xeedfade
exception.offset: 46887
exception.address: 0x7559b727
registers.esp: 53865668
registers.edi: 53865856
registers.eax: 53865668
registers.ebp: 53865748
registers.edx: 0
registers.ebx: 4703484
registers.esi: 11001
registers.ecx: 7
1 0 0
domain xred.mooo.com
request GET http://freedns.afraid.org/api/?action=getdyndns&sha=a30fa98efc092684e8d1c5cff797bcc613562978
request GET https://docs.google.com/uc?id=0BxsMXGfPIZfSTmlVYkxhSDg5TzQ&export=download
request GET https://drive.usercontent.google.com/download?id=0BxsMXGfPIZfSTmlVYkxhSDg5TzQ&export=download
request GET https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download
request GET https://drive.usercontent.google.com/download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download
Time & API Arguments Status Return Repeated

NtAllocateVirtualMemory

 process_identifier: 1072
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x00510000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2168
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x01f30000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0
name RT_ICON language LANG_TURKISH filetype dBase IV DBT of @.DBF, block length 8192, next free block index 40 sublanguage SUBLANG_DEFAULT offset 0x000b39f8 size 0x000010a8
name RT_ICON language LANG_TURKISH filetype dBase IV DBT of @.DBF, block length 8192, next free block index 40 sublanguage SUBLANG_DEFAULT offset 0x000b39f8 size 0x000010a8
name RT_RCDATA language LANG_TURKISH filetype Microsoft Excel 2007+ sublanguage SUBLANG_DEFAULT offset 0x000d81b8 size 0x000047d3
name RT_RCDATA language LANG_TURKISH filetype Microsoft Excel 2007+ sublanguage SUBLANG_DEFAULT offset 0x000d81b8 size 0x000047d3
name RT_RCDATA language LANG_TURKISH filetype Microsoft Excel 2007+ sublanguage SUBLANG_DEFAULT offset 0x000d81b8 size 0x000047d3
name RT_RCDATA language LANG_TURKISH filetype Microsoft Excel 2007+ sublanguage SUBLANG_DEFAULT offset 0x000d81b8 size 0x000047d3
name RT_RCDATA language LANG_TURKISH filetype Microsoft Excel 2007+ sublanguage SUBLANG_DEFAULT offset 0x000d81b8 size 0x000047d3
name RT_RCDATA language LANG_TURKISH filetype Microsoft Excel 2007+ sublanguage SUBLANG_DEFAULT offset 0x000d81b8 size 0x000047d3
name RT_RCDATA language LANG_TURKISH filetype Microsoft Excel 2007+ sublanguage SUBLANG_DEFAULT offset 0x000d81b8 size 0x000047d3
name RT_RCDATA language LANG_TURKISH filetype Microsoft Excel 2007+ sublanguage SUBLANG_DEFAULT offset 0x000d81b8 size 0x000047d3
name RT_GROUP_ICON language LANG_TURKISH filetype data sublanguage SUBLANG_DEFAULT offset 0x000dca18 size 0x00000014
name RT_VERSION language LANG_TURKISH filetype data sublanguage SUBLANG_DEFAULT offset 0x000dca2c size 0x00000304
domain docs.google.com
file C:\ProgramData\Synaptics\Synaptics.dll
file C:\Users\test22\AppData\Local\Temp\._cache_win11.exe
Time & API Arguments Status Return Repeated

CreateServiceA

 service_start_name:
start_type: 2
password:
display_name: Jklmno Qrstuvwx Abcdefgh Jklm
filepath: C:\Windows\pohbcu.exe
service_name: Jklmno
filepath_r: C:\Windows\pohbcu.exe
desired_access: 983551
service_handle: 0x008a5d38
error_control: 0
service_type: 272
service_manager_handle: 0x008a5e00
1 9067832 0
domain www.dropbox.com
Time & API Arguments Status Return Repeated

NtProtectVirtualMemory

 process_identifier: 2116
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
length: 28672
protection: 32 (PAGE_EXECUTE_READ)
base_address: 0x10001000
process_handle: 0xffffffff
1 0 0
host 38.147.172.248
reg_key HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\Synaptics Pointing Device Driver reg_value C:\ProgramData\Synaptics\Synaptics.exe
service_name Jklmno service_path C:\Windows\pohbcu.exe
Time & API Arguments Status Return Repeated

SetWindowsHookExA

 thread_identifier: 0
callback_function: 0x03363540
hook_identifier: 2 (WH_KEYBOARD)
module_address: 0x03360000
1 262647 0
registry HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\F81F111D0E5AB58D396F7BF525577FD30FDC95AA\Blob
process Synaptics.exe useragent MyApp
process Synaptics.exe useragent Synaptics.exe
Bkav W32.AIDetectMalware
Lionic Trojan.Win32.DarkKomet.tp6k
Cynet Malicious (score: 100)
CAT-QuickHeal Sus.Nocivo.E0011
Skyhigh BehavesLike.Win32.Synaptics.ch
ALYac Win32.Comet.A
Cylance Unsafe
VIPRE Win32.Comet.A
Sangfor Trojan.Win32.Save.a
CrowdStrike win/malicious_confidence_100% (W)
BitDefender Win32.Comet.A
K7GW Trojan ( 000112511 )
K7AntiVirus Trojan ( 000112511 )
Arcabit HEUR.VBA.Trojan.d
Symantec W32.Zorex
Elastic malicious (high confidence)
ESET-NOD32 Win32/Delf.NBX
APEX Malicious
Avast Win32:RATX-gen [Trj]
ClamAV Win.Trojan.Emotet-9850453-0
Kaspersky Backdoor.Win32.DarkKomet.hqxy
Alibaba Backdoor:Win32/DarkKomet.353
NANO-Antivirus Trojan.Win32.DarkKomet.fazbwq
SUPERAntiSpyware Adware.FileTour/Variant
MicroWorld-eScan Win32.Comet.A
Rising Virus.Synaptics!1.E51C (CLASSIC)
Emsisoft Win32.Comet.A (B)
F-Secure Trojan:W97M/MaliciousMacro.GEN
DrWeb Win32.HLLW.Siggen.10555
Zillya Trojan.Delf.Win32.76144
TrendMicro Virus.Win32.NAPWHICH.B
McAfeeD ti!E9C81976F863
CTX exe.trojan.generic
Sophos Troj/Farfli-DZ
SentinelOne Static AI - Malicious PE
FireEye Generic.mg.613d958a64df2e88
Jiangmin Win32/Synaptics.Gen
Webroot W32.Malware.gen
Google Detected
Avira TR/Injector.wqufb
Antiy-AVL Virus/Win32.DarkKomet.a
Kingsoft Win32.Infected.AutoInfector.a
Gridinsoft Trojan.Win32.Downloader.mz!n
Xcitium Virus.Win32.Agent.DE@74b38h
Microsoft Worm:Win32/AutoRun!atmn
ViRobot Win32.Zorex.A
ZoneAlarm Backdoor.Win32.DarkKomet.hqxy
GData Win32.Backdoor.Agent.AXS
Varist W32/Backdoor.OAZM-5661
AhnLab-V3 Win32/Zorex.X1799
dead_host 192.168.56.103:49181
dead_host 192.168.56.103:49180
dead_host 192.168.56.103:49182
dead_host 192.168.56.103:49177
dead_host 192.168.56.103:49165
dead_host 38.147.172.248:8001
dead_host 192.168.56.103:49179
dead_host 192.168.56.103:49178
dead_host 192.168.56.103:49167