Summary | ZeroBOX

Category	Machine	Started	Completed
FILE	s1_win7_x6401	Oct. 16, 2024, 11:09 a.m.	Oct. 16, 2024, 11:21 a.m.

Size	4.1MB
Type	PE32 executable (GUI) Intel 80386, for MS Windows
MD5	`ee2e125214ee4ebef8f570dd6f0d0cc4`
SHA256	`53bc0a58d5368873e733987740d91d32733311ed884915a2dc5dd2030a0b2c84`
CRC32	`1D2B24C9`
ssdeep	`98304:mSF8+rOqHMfkTjh/lDnetHhUHp9cmkLKr4iHCxGNi:mSF8qMMIuULaRNi`
PDB Path	wextract.pdb
Yara	Malicious_Library_Zero - Malicious_Library PE_Header_Zero - PE File Signature Win32_Trojan_Emotet_RL_Gen_Zero - Win32 Trojan Emotet CAB_file_format - CAB archive file IsPE32 - (no description) UPX_Zero - UPX packed file

center.exe "C:\Users\test22\AppData\Local\Temp\center.exe"
2548
- CenterRun.exe C:\Users\test22\AppData\Local\Temp\IXP000.TMP\CenterRun.exe
  2600
  - SeetrolCenter.exe "C:\Users\test22\Documents\seetrol\center\SeetrolCenter.exe"
    2744
explorer.exe C:\Windows\Explorer.EXE
1452

Name	Response	Post-Analysis Lookup
www.seetrol.com	A 139.150.75.206	139.150.75.206

IP Address	Status	Action
139.150.75.206	Active	Moloch
164.124.101.2	Active	Moloch
216.58.220.110	Active	Moloch

Suricata Alerts

Flow	SID	Signature	Category
TCP 192.168.56.101:49173 -> 139.150.75.206:80	2049137	ET ADWARE_PUP Seetrol Remote Administration Tool Download	Possibly Unwanted Program Detected
TCP 192.168.56.101:49168 -> 139.150.75.206:80	2020826	ET MALWARE Potential Dridex.Maldoc Minimal Executable Request	A Network Trojan was detected
TCP 192.168.56.101:49168 -> 139.150.75.206:80	2020826	ET MALWARE Potential Dridex.Maldoc Minimal Executable Request	A Network Trojan was detected
TCP 192.168.56.101:49168 -> 139.150.75.206:80	2020826	ET MALWARE Potential Dridex.Maldoc Minimal Executable Request	A Network Trojan was detected

Suricata TLS

No Suricata TLS

Queries for the computername (2 events)

Time & API	Arguments	Status	Return	Repeated
GetComputerNameW Oct. 16, 2024, 11:08 a.m.	computer_name: TEST22-PC	1	1	0
GetComputerNameW Oct. 16, 2024, 11:08 a.m.	computer_name: TEST22-PC	1	1	0

Checks if process is being debugged by a debugger (1 event)

Time & API	Arguments	Status	Return	Repeated
IsDebuggerPresent Oct. 16, 2024, 11:08 a.m.			0	0

This executable has a PDB path (1 event)

pdb_path

wextract.pdb

Checks amount of memory in system, this can be used to detect virtual machines that have a low amount of memory available (1 event)

Time & API	Arguments	Status	Return	Repeated
GlobalMemoryStatusEx Oct. 16, 2024, 11:08 a.m.		1	1	0

The file contains an unknown PE resource name possibly indicative of a packer (1 event)

resource name

AVI

Performs some HTTP requests (8 events)

request	GET http://www.seetrol.com/update3/STUpdate.exe
request	GET http://www.seetrol.com/update3/SeetrolClient.exe
request	GET http://www.seetrol.com/update3/Seetrol_Clt.exe
request	GET http://www.seetrol.com/update3/SeetrolMyService.exe
request	GET http://www.seetrol.com/update3/sthooks.dll
request	GET http://www.seetrol.com/update3/sas.dll
request	GET http://www.seetrol.com/update3/STKeyHook.dll
request	GET http://www.seetrol.com/update3/NetScan.exe

Allocates read-write-execute memory (usually to unpack itself) (20 events)

Time & API	Arguments	Status
NtProtectVirtualMemory Oct. 16, 2024, 11:08 a.m.	process_identifier: 2548 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x73941000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Oct. 16, 2024, 11:08 a.m.	process_identifier: 2548 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x73371000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Oct. 16, 2024, 11:08 a.m.	process_identifier: 2600 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x732c1000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Oct. 16, 2024, 11:08 a.m.	process_identifier: 2600 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x74191000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Oct. 16, 2024, 11:08 a.m.	process_identifier: 2600 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x72e04000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Oct. 16, 2024, 11:08 a.m.	process_identifier: 2600 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x732c2000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Oct. 16, 2024, 11:08 a.m.	process_identifier: 2600 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x73291000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Oct. 16, 2024, 11:08 a.m.	process_identifier: 2600 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x75b71000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Oct. 16, 2024, 11:08 a.m.	process_identifier: 2600 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x73931000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Oct. 16, 2024, 11:08 a.m.	process_identifier: 2600 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x728b1000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Oct. 16, 2024, 11:08 a.m.	process_identifier: 2600 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x73271000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Oct. 16, 2024, 11:08 a.m.	process_identifier: 2600 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x73331000 process_handle: 0xffffffff	1
NtAllocateVirtualMemory Oct. 16, 2024, 11:10 a.m.	process_identifier: 1452 region_size: 65536 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0000000004170000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory Oct. 16, 2024, 11:08 a.m.	process_identifier: 2744 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x741a1000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Oct. 16, 2024, 11:08 a.m.	process_identifier: 2744 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x72dd1000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Oct. 16, 2024, 11:08 a.m.	process_identifier: 2744 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x72d94000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Oct. 16, 2024, 11:08 a.m.	process_identifier: 2744 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x72dd2000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Oct. 16, 2024, 11:09 a.m.	process_identifier: 2744 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x74191000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Oct. 16, 2024, 11:09 a.m.	process_identifier: 2744 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x73291000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Oct. 16, 2024, 11:09 a.m.	process_identifier: 2744 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x72991000 process_handle: 0xffffffff	1

A process attempted to delay the analysis task. (1 event)

description

SeetrolCenter.exe tried to sleep 170 seconds, actually delayed analysis time by 170 seconds

Queries the disk size which could be used to detect virtual machine with small fixed size or dynamic allocation (3 events)

Time & API	Arguments	Status	Return
GetDiskFreeSpaceW Oct. 16, 2024, 11:08 a.m.	number_of_free_clusters: 3252241 sectors_per_cluster: 8 bytes_per_sector: 512 root_path: \ total_number_of_clusters: 8362495	1	1
GetDiskFreeSpaceW Oct. 16, 2024, 11:08 a.m.	number_of_free_clusters: 3252241 sectors_per_cluster: 8 bytes_per_sector: 512 root_path: \ total_number_of_clusters: 8362495	1	1
GetDiskFreeSpaceExW Oct. 16, 2024, 11:09 a.m.	total_number_of_free_bytes: 0 free_bytes_available: 13315747840 root_path: C:\Users\test22\AppData\Local\Microsoft\Windows\Explorer total_number_of_bytes: 0	1	1

Foreign language identified in PE resource (17 events)

name

AVI

language

LANG_KOREAN

filetype

RIFF (little-endian) data, AVI, 272 x 60, 10.00 fps, video: RLE 8bpp

sublanguage

SUBLANG_KOREAN

offset

0x0000d7e8

size

0x00002e1a

name

RT_ICON

language

LANG_KOREAN

filetype

GLS_BINARY_LSB_FIRST

sublanguage

SUBLANG_KOREAN

offset

0x000108ec

size

0x00000128

name

RT_ICON

language

LANG_KOREAN

filetype

GLS_BINARY_LSB_FIRST

sublanguage

SUBLANG_KOREAN

offset

0x000108ec

size

0x00000128

name

RT_DIALOG

language

LANG_KOREAN

filetype

data

sublanguage

SUBLANG_KOREAN

offset

0x000110cc

size

0x000000e0

name

RT_DIALOG

language

LANG_KOREAN

filetype

data

sublanguage

SUBLANG_KOREAN

offset

0x000110cc

size

0x000000e0

name

RT_DIALOG

language

LANG_KOREAN

filetype

data

sublanguage

SUBLANG_KOREAN

offset

0x000110cc

size

0x000000e0

name

RT_DIALOG

language

LANG_KOREAN

filetype

data

sublanguage

SUBLANG_KOREAN

offset

0x000110cc

size

0x000000e0

name

RT_DIALOG

language

LANG_KOREAN

filetype

data

sublanguage

SUBLANG_KOREAN

offset

0x000110cc

size

0x000000e0

name

RT_DIALOG

language

LANG_KOREAN

filetype

data

sublanguage

SUBLANG_KOREAN

offset

0x000110cc

size

0x000000e0

name

RT_STRING

language

LANG_KOREAN

filetype

data

sublanguage

SUBLANG_KOREAN

offset

0x00011d78

size

0x000001d8

name

RT_STRING

language

LANG_KOREAN

filetype

data

sublanguage

SUBLANG_KOREAN

offset

0x00011d78

size

0x000001d8

name

RT_STRING

language

LANG_KOREAN

filetype

data

sublanguage

SUBLANG_KOREAN

offset

0x00011d78

size

0x000001d8

name

RT_STRING

language

LANG_KOREAN

filetype

data

sublanguage

SUBLANG_KOREAN

offset

0x00011d78

size

0x000001d8

name

RT_STRING

language

LANG_KOREAN

filetype

data

sublanguage

SUBLANG_KOREAN

offset

0x00011d78

size

0x000001d8

name

RT_STRING

language

LANG_KOREAN

filetype

data

sublanguage

SUBLANG_KOREAN

offset

0x00011d78

size

0x000001d8

name

RT_GROUP_ICON

language

LANG_KOREAN

filetype

data

sublanguage

SUBLANG_KOREAN

offset

0x0041e2e4

size

0x00000022

name

RT_VERSION

language

LANG_KOREAN

filetype

data

sublanguage

SUBLANG_KOREAN

offset

0x0041e308

size

0x00000440

Creates executable files on the filesystem (16 events)

file	C:\Users\test22\Documents\seetrol\center\NetScan.exe
file	C:\Users\test22\Desktop\Seetrol Center.lnk
file	C:\Program Files (x86)\seetrol\client\Seetrol_Clt.exe
file	C:\Users\test22\AppData\Local\Temp\IXP000.TMP\drmclien.dll
file	C:\Program Files (x86)\seetrol\client\SeetrolClient.exe
file	C:\Program Files (x86)\seetrol\client\SeetrolMyService.exe
file	C:\Users\test22\AppData\Local\Temp\IXP000.TMP\wmasf.dll
file	C:\Users\test22\AppData\Local\Temp\IXP000.TMP\SeetrolCenter.exe
file	C:\Users\test22\AppData\Local\Temp\IXP000.TMP\Seetrol_Cnt.exe
file	C:\Users\test22\Documents\seetrol\center\STUpdate.exe
file	C:\Program Files (x86)\seetrol\client\sthooks.dll
file	C:\Users\test22\Documents\seetrol\center\STKeyHook.dll
file	C:\Program Files (x86)\seetrol\client\sas.dll
file	C:\Users\test22\AppData\Local\Temp\IXP000.TMP\wmidx.dll
file	C:\Users\test22\AppData\Local\Temp\IXP000.TMP\CenterRun.exe
file	C:\Users\test22\AppData\Local\Temp\IXP000.TMP\wmvcore.dll

Creates a shortcut to an executable file (1 event)

file	C:\Users\test22\Desktop\Seetrol Center.lnk

File has been identified by 2 AntiVirus engines on VirusTotal as malicious (2 events)

VBA32	BScope.Trojan.Gofot
Ikarus	Trojan.Crypt

The binary likely contains encrypted or compressed data indicative of a packer (2 events)

section

{u'size_of_data': u'0x00411a00', u'virtual_address': u'0x0000d000', u'entropy': 7.998233401968615, u'name': u'.rsrc', u'virtual_size': u'0x00411968'}

entropy

7.99823340197

description

A section with a high entropy has been found

entropy

0.990608654303

description

Overall entropy of this PE file is high

Communicates with host for which no DNS query was performed (1 event)

host

216.58.220.110

Installs itself for autorun at Windows startup (1 event)

reg_key

HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0

reg_value

rundll32.exe C:\Windows\system32\advpack.dll,DelNodeRunDLL32 "C:\Users\test22\AppData\Local\Temp\IXP000.TMP\"

center.exe

Process Tree Toggle all

Network Toggle all

Suricata Toggle all

Suricata Alerts

Suricata TLS

Signatures Toggle All