Summary | ZeroBOX

Category	Machine	Started	Completed
FILE	s1_win7_x6401	Dec. 16, 2024, 6:01 p.m.	Dec. 16, 2024, 6:07 p.m.

Size	124.0KB
Type	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
MD5	`c2f3fbbbe6d5f48a71b6b168b1485866`
SHA256	`c7ed512058bc924045144daa16701da10f244ac12a5ea2de901e59dce6470839`
CRC32	`F31C9984`
ssdeep	`3072:Vdu5ZXB8ZuzQT7SgmME8Yn/YoZ3SNqpidU1epf:WjGymSg7E8Y3Z3AdUwpf`
Yara	Malicious_Library_Zero - Malicious_Library IsDLL - (no description) Win_Amadey_Zero - Amadey bot IsPE32 - (no description) PE_Header_Zero - PE File Signature Generic_Malware_Zero - Generic Malware UPX_Zero - UPX packed file OS_Processor_Check_Zero - OS Processor Check

rundll32.exe "C:\Windows\System32\rundll32.exe" C:\Users\test22\AppData\Local\Temp\clip64.dll,??4CClipperDLL@@QAEAAV0@ABV0@@Z
2636
rundll32.exe "C:\Windows\System32\rundll32.exe" C:\Users\test22\AppData\Local\Temp\clip64.dll,??4CClipperDLL@@QAEAAV0@$$QAV0@@Z
2552
rundll32.exe "C:\Windows\System32\rundll32.exe" C:\Users\test22\AppData\Local\Temp\clip64.dll,Main
2728
rundll32.exe "C:\Windows\System32\rundll32.exe" C:\Users\test22\AppData\Local\Temp\clip64.dll,
2824

Name	Response	Post-Analysis Lookup
No hosts contacted.

IP Address	Status	Action
185.81.68.147	Active	Moloch
185.81.68.148	Active	Moloch

Suricata Alerts

Flow	SID	Signature	Category
TCP 185.81.68.147:80 -> 192.168.56.101:49164	2400031	ET DROP Spamhaus DROP Listed Traffic Inbound group 32	Misc Attack
TCP 185.81.68.148:80 -> 192.168.56.101:49166	2400031	ET DROP Spamhaus DROP Listed Traffic Inbound group 32	Misc Attack

Suricata TLS

No Suricata TLS

Checks if process is being debugged by a debugger (3 events)

Time & API	Arguments	Status	Return	Repeated
IsDebuggerPresent Dec. 16, 2024, 6:01 p.m.			0	0
IsDebuggerPresent Dec. 16, 2024, 6:01 p.m.			0	0
IsDebuggerPresent Dec. 16, 2024, 6:01 p.m.			0	0

HTTP traffic contains suspicious features which may be indicative of malware related traffic (2 events)

suspicious_features	POST method with no referer header, POST method with no useragent header, Connection to IP address				suspicious_request	POST http://185.81.68.147/7vhfjke3/index.php
suspicious_features	POST method with no referer header, POST method with no useragent header, Connection to IP address				suspicious_request	POST http://185.81.68.148/8Fvu5jh4DbS/index.php

Performs some HTTP requests (2 events)

request	POST http://185.81.68.147/7vhfjke3/index.php
request	POST http://185.81.68.148/8Fvu5jh4DbS/index.php

Sends data using the HTTP POST Method (2 events)

request	POST http://185.81.68.147/7vhfjke3/index.php
request	POST http://185.81.68.148/8Fvu5jh4DbS/index.php

Allocates read-write-execute memory (usually to unpack itself) (30 events)

Time & API	Arguments	Status
NtProtectVirtualMemory Dec. 16, 2024, 6:01 p.m.	process_identifier: 2552 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x73be6000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Dec. 16, 2024, 6:01 p.m.	process_identifier: 2552 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x75d41000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Dec. 16, 2024, 6:01 p.m.	process_identifier: 2552 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x75e61000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Dec. 16, 2024, 6:01 p.m.	process_identifier: 2552 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x76161000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Dec. 16, 2024, 6:01 p.m.	process_identifier: 2552 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x73660000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Dec. 16, 2024, 6:01 p.m.	process_identifier: 2552 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x735e1000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Dec. 16, 2024, 6:01 p.m.	process_identifier: 2552 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x73551000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Dec. 16, 2024, 6:01 p.m.	process_identifier: 2552 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x73514000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Dec. 16, 2024, 6:01 p.m.	process_identifier: 2552 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x735e2000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Dec. 16, 2024, 6:01 p.m.	process_identifier: 2552 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x73c11000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Dec. 16, 2024, 6:01 p.m.	process_identifier: 2636 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x73be6000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Dec. 16, 2024, 6:01 p.m.	process_identifier: 2636 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x75d41000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Dec. 16, 2024, 6:01 p.m.	process_identifier: 2636 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x75e61000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Dec. 16, 2024, 6:01 p.m.	process_identifier: 2636 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x76161000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Dec. 16, 2024, 6:01 p.m.	process_identifier: 2636 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x73660000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Dec. 16, 2024, 6:01 p.m.	process_identifier: 2636 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x735e1000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Dec. 16, 2024, 6:01 p.m.	process_identifier: 2636 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x73551000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Dec. 16, 2024, 6:01 p.m.	process_identifier: 2636 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x73514000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Dec. 16, 2024, 6:01 p.m.	process_identifier: 2636 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x735e2000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Dec. 16, 2024, 6:01 p.m.	process_identifier: 2636 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x73c11000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Dec. 16, 2024, 6:01 p.m.	process_identifier: 2728 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x73be6000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Dec. 16, 2024, 6:01 p.m.	process_identifier: 2728 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x75d41000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Dec. 16, 2024, 6:01 p.m.	process_identifier: 2728 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x75e61000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Dec. 16, 2024, 6:01 p.m.	process_identifier: 2728 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x76161000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Dec. 16, 2024, 6:01 p.m.	process_identifier: 2728 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x73660000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Dec. 16, 2024, 6:01 p.m.	process_identifier: 2728 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x735e1000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Dec. 16, 2024, 6:01 p.m.	process_identifier: 2728 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x73551000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Dec. 16, 2024, 6:01 p.m.	process_identifier: 2728 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x73514000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Dec. 16, 2024, 6:01 p.m.	process_identifier: 2728 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x735e2000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Dec. 16, 2024, 6:01 p.m.	process_identifier: 2728 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x73c11000 process_handle: 0xffffffff	1

Communicates with host for which no DNS query was performed (2 events)

host	185.81.68.147
host	185.81.68.148

File has been identified by 54 AntiVirus engines on VirusTotal as malicious (50 out of 54 events)

Bkav	W32.Common.28B8C7F3
Lionic	Trojan.Win32.ClipBanker.Z!c
Cynet	Malicious (score: 100)
CAT-QuickHeal	Trojan.Nymaim
Skyhigh	BehavesLike.Win32.NetLoader.ch
ALYac	Gen:Variant.Lazy.623345
Cylance	Unsafe
VIPRE	Gen:Variant.Lazy.623345
Sangfor	Banker.Win32.Clipbanker.Vwem
CrowdStrike	win/malicious_confidence_100% (W)
BitDefender	Gen:Variant.Lazy.623345
K7GW	Trojan ( 005b155f1 )
K7AntiVirus	Trojan ( 005b155f1 )
Arcabit	Trojan.Lazy.D982F1
Symantec	ML.Attribute.HighConfidence
Elastic	malicious (high confidence)
ESET-NOD32	a variant of Win32/ClipBanker.SJ
Avast	Win32:TrojanX-gen [Trj]
ClamAV	Win.Malware.Zusy-10015683-0
Kaspersky	Trojan.Win32.Nymaim.cdjm
Alibaba	Trojan:Win32/Nymaim.a6f894fd
NANO-Antivirus	Trojan.Win32.Nymaim.kuavkx
MicroWorld-eScan	Gen:Variant.Lazy.623345
Rising	Trojan.ClipBanker!8.5FB (TFE:5:ejfSgHdx95N)
Emsisoft	Gen:Variant.Lazy.623345 (B)
F-Secure	Trojan.TR/ClipBanker.biwhb
TrendMicro	Trojan.Win32.AMADEY.YXELLZ
McAfeeD	ti!C7ED512058BC
CTX	dll.trojan.clipbanker
Sophos	Troj/Amadey-Gen
FireEye	Gen:Variant.Lazy.623345
Webroot	W32.Trojan.Gen
Google	Detected
Avira	TR/ClipBanker.biwhb
Antiy-AVL	Trojan/Win32.Nymaim
Kingsoft	Win32.Trojan.Nymaim.cdjm
Gridinsoft	Ransom.Win32.Banker.sa
Microsoft	Trojan:Win32/Amadey.MA!MTB
ViRobot	Trojan.Win.Z.Lazy.126976.FHX
GData	Win32.Trojan-Stealer.Amadey.F
Varist	W32/ABTrojan.AJON-1335
AhnLab-V3	Trojan/Win.Amadey.C5684740
McAfee	Artemis!C2F3FBBBE6D5
DeepInstinct	MALICIOUS
Malwarebytes	Trojan.ClipBanker
Ikarus	Trojan.Win32.Clipbanker
Panda	Trj/GdSda.A
TrendMicro-HouseCall	Trojan.Win32.AMADEY.YXELLZ
Tencent	Malware.Win32.Gencirc.14253e6e
huorong	TrojanSpy/ClipBanker.y

clip64.dll

Process Tree Toggle all

Network Toggle all

Suricata Toggle all

Suricata Alerts

Suricata TLS

Signatures Toggle All