Summary | ZeroBOX

Category	Machine	Started	Completed
FILE	s1_win7_x6401	Nov. 13, 2024, 1:55 p.m.	Nov. 13, 2024, 1:57 p.m.

Size	124.0KB
Type	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
MD5	`0d3418372c854ee228b78e16ea7059be`
SHA256	`885bf0b3b12b77ef3f953fbb48def1b45079faa2a4d574ee16afdbafa1de3ac7`
CRC32	`7EB42513`
ssdeep	`3072:pdUmIYSBYZuziT7Sgmu1ErYn/YoZ3SNqkoZidU1epo:ABY7yASgb1ErY3Z3soodUwpo`
Yara	Win_Amadey_Zero - Amadey bot Malicious_Library_Zero - Malicious_Library PE_Header_Zero - PE File Signature IsDLL - (no description) IsPE32 - (no description) Generic_Malware_Zero - Generic Malware UPX_Zero - UPX packed file OS_Processor_Check_Zero - OS Processor Check

rundll32.exe "C:\Windows\System32\rundll32.exe" C:\Users\test22\AppData\Local\Temp\clip.dll,??4CClipperDLL@@QAEAAV0@$$QAV0@@Z
2556
rundll32.exe "C:\Windows\System32\rundll32.exe" C:\Users\test22\AppData\Local\Temp\clip.dll,??4CClipperDLL@@QAEAAV0@ABV0@@Z
2640
rundll32.exe "C:\Windows\System32\rundll32.exe" C:\Users\test22\AppData\Local\Temp\clip.dll,Main
2732
rundll32.exe "C:\Windows\System32\rundll32.exe" C:\Users\test22\AppData\Local\Temp\clip.dll,
2820

Name	Response	Post-Analysis Lookup
No hosts contacted.

IP Address	Status	Action
185.215.113.209	Active	Moloch

Suricata Alerts

No Suricata Alerts

Suricata TLS

No Suricata TLS

Checks if process is being debugged by a debugger (3 events)

Time & API	Arguments	Status	Return	Repeated
IsDebuggerPresent Nov. 13, 2024, 1:55 p.m.			0	0
IsDebuggerPresent Nov. 13, 2024, 1:55 p.m.			0	0
IsDebuggerPresent Nov. 13, 2024, 1:55 p.m.			0	0

Allocates read-write-execute memory (usually to unpack itself) (30 events)

Time & API	Arguments	Status
NtProtectVirtualMemory Nov. 13, 2024, 1:55 p.m.	process_identifier: 2556 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x73be6000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Nov. 13, 2024, 1:55 p.m.	process_identifier: 2556 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x75d41000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Nov. 13, 2024, 1:55 p.m.	process_identifier: 2556 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x75e61000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Nov. 13, 2024, 1:55 p.m.	process_identifier: 2556 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x76161000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Nov. 13, 2024, 1:55 p.m.	process_identifier: 2556 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x73660000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Nov. 13, 2024, 1:55 p.m.	process_identifier: 2556 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x73571000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Nov. 13, 2024, 1:55 p.m.	process_identifier: 2556 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x734e1000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Nov. 13, 2024, 1:55 p.m.	process_identifier: 2556 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x734a4000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Nov. 13, 2024, 1:55 p.m.	process_identifier: 2556 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x73572000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Nov. 13, 2024, 1:55 p.m.	process_identifier: 2556 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x73c11000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Nov. 13, 2024, 1:55 p.m.	process_identifier: 2640 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x73be6000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Nov. 13, 2024, 1:55 p.m.	process_identifier: 2640 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x75d41000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Nov. 13, 2024, 1:55 p.m.	process_identifier: 2640 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x75e61000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Nov. 13, 2024, 1:55 p.m.	process_identifier: 2640 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x76161000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Nov. 13, 2024, 1:55 p.m.	process_identifier: 2640 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x73660000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Nov. 13, 2024, 1:55 p.m.	process_identifier: 2640 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x73571000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Nov. 13, 2024, 1:55 p.m.	process_identifier: 2640 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x734e1000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Nov. 13, 2024, 1:55 p.m.	process_identifier: 2640 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x734a4000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Nov. 13, 2024, 1:55 p.m.	process_identifier: 2640 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x73572000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Nov. 13, 2024, 1:55 p.m.	process_identifier: 2640 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x73c11000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Nov. 13, 2024, 1:55 p.m.	process_identifier: 2732 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x73be6000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Nov. 13, 2024, 1:55 p.m.	process_identifier: 2732 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x75d41000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Nov. 13, 2024, 1:55 p.m.	process_identifier: 2732 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x75e61000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Nov. 13, 2024, 1:55 p.m.	process_identifier: 2732 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x76161000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Nov. 13, 2024, 1:55 p.m.	process_identifier: 2732 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x73660000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Nov. 13, 2024, 1:55 p.m.	process_identifier: 2732 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x73571000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Nov. 13, 2024, 1:55 p.m.	process_identifier: 2732 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x734e1000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Nov. 13, 2024, 1:55 p.m.	process_identifier: 2732 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x734a4000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Nov. 13, 2024, 1:55 p.m.	process_identifier: 2732 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x73572000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Nov. 13, 2024, 1:55 p.m.	process_identifier: 2732 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x73bb1000 process_handle: 0xffffffff	1

Communicates with host for which no DNS query was performed (1 event)

host

185.215.113.209

Connects to an IP address that is no longer responding to requests (legitimate services will remain up-and-running usually) (1 event)

dead_host

185.215.113.209:80

File has been identified by 55 AntiVirus engines on VirusTotal as malicious (50 out of 55 events)

Bkav	W32.AIDetectMalware
Lionic	Trojan.Win32.ClipBanker.Z!c
Cynet	Malicious (score: 100)
CAT-QuickHeal	Trojan.Agent
Skyhigh	BehavesLike.Win32.NetLoader.ch
ALYac	Trojan.GenericKD.74748467
Cylance	Unsafe
VIPRE	Trojan.GenericKD.74748467
CrowdStrike	win/malicious_confidence_90% (W)
BitDefender	Trojan.GenericKD.74748467
K7GW	Trojan ( 005b155f1 )
K7AntiVirus	Trojan ( 005b155f1 )
Arcabit	Trojan.Generic.D4749233
Symantec	ML.Attribute.HighConfidence
Elastic	malicious (high confidence)
ESET-NOD32	a variant of Win32/ClipBanker.SJ
Avast	Win32:TrojanX-gen [Trj]
ClamAV	Win.Malware.Zusy-10015683-0
Kaspersky	Trojan.Win32.Agent.xbudtu
Alibaba	Trojan:Win32/Amadey.934a1625
MicroWorld-eScan	Trojan.GenericKD.74748467
Rising	Trojan.ClipBanker!8.5FB (TFE:5:ejfSgHdx95N)
Emsisoft	Trojan.GenericKD.74748467 (B)
F-Secure	Trojan.TR/ClipBanker.sxlrr
DrWeb	Trojan.PWS.Amadey.18
Zillya	Trojan.Agent.Win32.4041657
TrendMicro	TROJ_GEN.R014C0DKA24
McAfeeD	ti!885BF0B3B12B
CTX	dll.trojan.clipbanker
Sophos	Mal/Generic-S
FireEye	Trojan.GenericKD.74748467
Google	Detected
Avira	TR/ClipBanker.sxlrr
Antiy-AVL	Trojan/Win32.Amadey
Kingsoft	Win32.Trojan.Agent.xbudtu
Gridinsoft	Trojan.Win32.Amadey.tr
Microsoft	Trojan:Win32/Amadey.MA!MTB
ViRobot	Trojan.Win.Z.Lazy.126976.FHU
ZoneAlarm	UDS:DangerousObject.Multi.Generic
GData	Trojan.GenericKD.74748467
Varist	W32/ABTrojan.CRHJ-7824
AhnLab-V3	Trojan/Win.Amadey.C5684740
McAfee	Artemis!0D3418372C85
DeepInstinct	MALICIOUS
VBA32	TrojanDownloader.Deyma
Malwarebytes	Trojan.ClipBanker
Ikarus	Trojan.Win32.Clipbanker
Panda	Trj/GdSda.A
TrendMicro-HouseCall	TROJ_GEN.R014C0DKA24
Tencent	Malware.Win32.Gencirc.11cb7ef6

clip.dll

Process Tree Toggle all

Network Toggle all

Suricata Toggle all

Suricata Alerts

Suricata TLS

Signatures Toggle All