Summary | ZeroBOX

Category	Machine	Started	Completed
FILE	s1_win7_x6403_us	Nov. 7, 2024, 12:59 p.m.	Nov. 7, 2024, 1:01 p.m.

Size	124.0KB
Type	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
MD5	`bafdcab94b81531cb38dc51e7efe3ddd`
SHA256	`c0e5dc55a71407fadd16147ce52d724943de64607788ff587acfd833b0874ca5`
CRC32	`F019CF93`
ssdeep	`3072:fBgSZXB8ZuzQT7SgmwE88H/Y4Z3SNqFidU1ep/:eoGymSg/E88XZ3MdUwp/`
Yara	Win_Amadey_Zero - Amadey bot Malicious_Library_Zero - Malicious_Library PE_Header_Zero - PE File Signature IsDLL - (no description) IsPE32 - (no description) Generic_Malware_Zero - Generic Malware UPX_Zero - UPX packed file OS_Processor_Check_Zero - OS Processor Check

rundll32.exe "C:\Windows\System32\rundll32.exe" C:\Users\test22\AppData\Local\Temp\clip64.dll,??4CClipperDLL@@QAEAAV0@$$QAV0@@Z
1648
rundll32.exe "C:\Windows\System32\rundll32.exe" C:\Users\test22\AppData\Local\Temp\clip64.dll,??4CClipperDLL@@QAEAAV0@ABV0@@Z
2064
rundll32.exe "C:\Windows\System32\rundll32.exe" C:\Users\test22\AppData\Local\Temp\clip64.dll,Main
2160
rundll32.exe "C:\Windows\System32\rundll32.exe" C:\Users\test22\AppData\Local\Temp\clip64.dll,
2252

Name	Response	Post-Analysis Lookup
No hosts contacted.

IP Address	Status	Action
185.208.159.121	Active	Moloch

Suricata Alerts

No Suricata Alerts

Suricata TLS

No Suricata TLS

Checks if process is being debugged by a debugger (3 events)

Time & API	Arguments	Status	Return	Repeated
IsDebuggerPresent Nov. 7, 2024, 12:59 p.m.			0	0
IsDebuggerPresent Nov. 7, 2024, 12:59 p.m.			0	0
IsDebuggerPresent Nov. 7, 2024, 12:59 p.m.			0	0

Allocates read-write-execute memory (usually to unpack itself) (18 events)

Time & API	Arguments	Status
NtProtectVirtualMemory Nov. 7, 2024, 12:59 p.m.	process_identifier: 1648 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x744c6000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Nov. 7, 2024, 12:59 p.m.	process_identifier: 1648 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x75931000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Nov. 7, 2024, 12:59 p.m.	process_identifier: 1648 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x76e01000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Nov. 7, 2024, 12:59 p.m.	process_identifier: 1648 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x752e1000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Nov. 7, 2024, 12:59 p.m.	process_identifier: 1648 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x743c0000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Nov. 7, 2024, 12:59 p.m.	process_identifier: 1648 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x74491000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Nov. 7, 2024, 12:59 p.m.	process_identifier: 2064 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x744c6000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Nov. 7, 2024, 12:59 p.m.	process_identifier: 2064 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x75931000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Nov. 7, 2024, 12:59 p.m.	process_identifier: 2064 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x76e01000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Nov. 7, 2024, 12:59 p.m.	process_identifier: 2064 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x752e1000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Nov. 7, 2024, 12:59 p.m.	process_identifier: 2064 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x74440000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Nov. 7, 2024, 12:59 p.m.	process_identifier: 2064 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x744f1000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Nov. 7, 2024, 12:59 p.m.	process_identifier: 2160 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x744c6000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Nov. 7, 2024, 12:59 p.m.	process_identifier: 2160 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x75931000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Nov. 7, 2024, 12:59 p.m.	process_identifier: 2160 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x76e01000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Nov. 7, 2024, 12:59 p.m.	process_identifier: 2160 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x752e1000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Nov. 7, 2024, 12:59 p.m.	process_identifier: 2160 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x74440000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Nov. 7, 2024, 12:59 p.m.	process_identifier: 2160 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x744f1000 process_handle: 0xffffffff	1

Communicates with host for which no DNS query was performed (1 event)

host

185.208.159.121

Connects to an IP address that is no longer responding to requests (legitimate services will remain up-and-running usually) (1 event)

dead_host

185.208.159.121:80

File has been identified by 39 AntiVirus engines on VirusTotal as malicious (39 events)

Bkav	W32.AIDetectMalware
Lionic	Trojan.Win32.ClipBanker.Z!c
ClamAV	Win.Malware.Zusy-10015683-0
CTX	dll.trojan.clipbanker
CAT-QuickHeal	Trojan.Agent
ALYac	Gen:Variant.Zusy.446682
Cylance	Unsafe
CrowdStrike	win/malicious_confidence_90% (D)
K7GW	Trojan ( 005b15cb1 )
K7AntiVirus	Trojan ( 005b15cb1 )
Symantec	ML.Attribute.HighConfidence
Elastic	malicious (high confidence)
ESET-NOD32	a variant of Win32/ClipBanker.SJ
Paloalto	generic.ml
Cynet	Malicious (score: 100)
Alibaba	Trojan:Win32/Amadey.ca16bffa
MicroWorld-eScan	Gen:Variant.Zusy.446682
Emsisoft	Gen:Variant.Zusy.446682 (B)
TrendMicro	TROJ_GEN.R014C0DK124
McAfeeD	ti!C0E5DC55A714
Sophos	Mal/Generic-S
Avira	TR/ClipBanker.tfcgw
Antiy-AVL	Trojan/Win32.Amadey
Kingsoft	Win32.Troj.Unknown.a
Gridinsoft	Ransom.Win32.Banker.sa
Arcabit	Trojan.Zusy.D6D0DA
ViRobot	Trojan.Win.Z.Zusy.126976.C
Microsoft	Trojan:Win32/Amadey.MA!MTB
AhnLab-V3	Trojan/Win.Amadey.C5684740
VBA32	TrojanDownloader.Deyma
DeepInstinct	MALICIOUS
Malwarebytes	Trojan.ClipBanker
Ikarus	Trojan.Win32.Clipbanker
TrendMicro-HouseCall	TROJ_GEN.R014C0DK124
Tencent	Malware.Win32.Gencirc.11caf0d6
huorong	TrojanSpy/ClipBanker.y
MaxSecure	Trojan.Malware.1728101.susgen
Fortinet	W32/ClipBanker.SJ!tr
Panda	Trj/GdSda.A

clip64.dll

Process Tree Toggle all

Network Toggle all

Suricata Toggle all

Suricata Alerts

Suricata TLS

Signatures Toggle All