popup
Summary | ZeroBOX
  1. Home
  2. Result
  3. Report
  4. Detail Analysis

Getdp.exe

Emotet Gen1 Generic Malware Malicious Library UPX PE64 MZP Format PE File OS Processor Check PE32 DLL
  1. Resubmit sample
Category Machine Started Completed
FILE s1_win7_x6402 Nov. 19, 2024, 2:39 p.m. Nov. 19, 2024, 2:42 p.m.
Size 736.3KB
Type PE32 executable (GUI) Intel 80386, for MS Windows
MD5 4450ac5d9c08453f7faa1c3f9569350e
SHA256 057ca3a5512eeffd679e2ad93bbfa86ad88398d35addda66502115cf54e91c06
CRC32 6ECACFF8
ssdeep 12288:KQiGZASXj0BL0YvEgpzDXplSH549k1l2i/ykG0TMOUHbzMUFIKiM:KQiggKY5/8T+i/ykLDUGKN
Yara
  • Malicious_Library_Zero - Malicious_Library
  • IsPE32 - (no description)
  • PE_Header_Zero - PE File Signature
  • Win32_Trojan_Emotet_2_Zero - Win32 Trojan Emotet
  • UPX_Zero - UPX packed file
  • mzp_file_format - MZP(Delphi) file format

Name Response Post-Analysis Lookup
No hosts contacted.
IP Address Status Action
164.124.101.2 Active Moloch

Suricata Alerts

No Suricata Alerts

Suricata TLS

No Suricata TLS

Time & API Arguments Status Return Repeated

GetComputerNameW

 computer_name: TEST22-PC
1 1 0
Time & API Arguments Status Return Repeated

IsDebuggerPresent

 0 0
Time & API Arguments Status Return Repeated

GlobalMemoryStatusEx

 1 1 0
section CODE
section DATA
section BSS
Time & API Arguments Status Return Repeated

NtProtectVirtualMemory

 process_identifier: 3000
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x00400000
process_handle: 0xffffffff
1 0 0

NtProtectVirtualMemory

 process_identifier: 3000
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 40960
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x00401000
process_handle: 0xffffffff
1 0 0

NtProtectVirtualMemory

 process_identifier: 3000
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 20480
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x0040f000
process_handle: 0xffffffff
1 0 0

NtProtectVirtualMemory

 process_identifier: 3000
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x741b2000
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 964
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x01dc0000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtProtectVirtualMemory

 process_identifier: 964
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x741b2000
process_handle: 0xffffffff
1 0 0

NtProtectVirtualMemory

 process_identifier: 964
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x73ef3000
process_handle: 0xffffffff
1 0 0
file C:\Users\test22\AppData\Local\Temp\is-ESS4Q.tmp\isxdl.dll
file C:\Users\test22\AppData\Local\Temp\is-ESS4Q.tmp\_isetup\_shfoldr.dll
file C:\Users\test22\AppData\Local\Temp\is-ESS4Q.tmp\isskin.dll
cmdline "C:\Windows\system32\cmd.exe" /c tasklist>"C:\Users\test22\AppData\Local\Temp\is-ESS4Q.tmp"\tasklist.txt
file C:\Users\test22\AppData\Local\Temp\is-ESS4Q.tmp\isskin.dll
file C:\Users\test22\AppData\Local\Temp\is-ESS4Q.tmp\Office2007.cjstyles
file C:\Users\test22\AppData\Local\Temp\is-ESS4Q.tmp\_isetup\_shfoldr.dll
file C:\Users\test22\AppData\Local\Temp\is-ESS4Q.tmp\isxdl.dll
file C:\Users\test22\AppData\Local\Temp\is-N2J6P.tmp\Getdp.tmp
wmi SELECT __PATH, ProcessId, CSName, Caption, SessionId, ThreadCount, WorkingSetSize, KernelModeTime, UserModeTime FROM Win32_Process
APEX Malicious
Kingsoft malware.kb.a.800
Time & API Arguments Status Return Repeated

LookupPrivilegeValueW

 system_name:
privilege_name: SeDebugPrivilege
1 1 0
Time & API Arguments Status Return Repeated

RegOpenKeyExA

 regkey_r: Software\Microsoft\Windows\CurrentVersion\Uninstall\Atualizador DP_is1
base_handle: 0x80000001
key_handle: 0x00000000
options: 0
access: 0x00000001
regkey: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Uninstall\Atualizador DP_is1
2 0

RegOpenKeyExA

 regkey_r: Software\Microsoft\Windows\CurrentVersion\Uninstall\Atualizador DP_is1
base_handle: 0x80000002
key_handle: 0x00000000
options: 0
access: 0x00000001
regkey: HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Uninstall\Atualizador DP_is1
2 0
cmdline "C:\Windows\system32\cmd.exe" /c tasklist>"C:\Users\test22\AppData\Local\Temp\is-ESS4Q.tmp"\tasklist.txt
cmdline tasklist