popup
Summary | ZeroBOX
  1. Home
  2. Result
  3. Report
  4. Detail Analysis

stail.exe

Emotet Gen1 Generic Malware Malicious Library UPX PE64 MZP Format PE File OS Processor Check PE32 DLL CHM Format
  1. Resubmit sample
Category Machine Started Completed
FILE s1_win7_x6403_us Dec. 19, 2024, 8:34 a.m. Dec. 19, 2024, 8:39 a.m.
Size 3.4MB
Type PE32 executable (GUI) Intel 80386, for MS Windows
MD5 8e48644d626b1e2ee1a0fe4f117848ba
SHA256 5990fff771e2cb6f4a7daf3558beaa73965080d79c996216027c6a885f67789b
CRC32 561CC219
ssdeep 98304:MUnOIMobjxdn4330CpzeE3MnIMzEahC/mZ+zBQjHbAKoPgS:5Fdng30It3GzNhEzyb0KoV
Yara
  • Malicious_Library_Zero - Malicious_Library
  • PE_Header_Zero - PE File Signature
  • Win32_Trojan_Emotet_2_Zero - Win32 Trojan Emotet
  • IsPE32 - (no description)
  • mzp_file_format - MZP(Delphi) file format
  • UPX_Zero - UPX packed file

Name Response Post-Analysis Lookup
No hosts contacted.
IP Address Status Action
No hosts contacted.

Suricata Alerts

No Suricata Alerts

Suricata TLS

No Suricata TLS

Time & API Arguments Status Return Repeated

GetComputerNameA

 computer_name: TEST22-PC
1 1 0
Time & API Arguments Status Return Repeated

IsDebuggerPresent

 0 0
section CODE
section DATA
section BSS
Time & API Arguments Status Return Repeated

__exception__

 stacktrace: 
stail+0x3e2e6 @ 0x43e2e6
stail+0x3d6f7 @ 0x43d6f7
stail+0x94e16 @ 0x494e16
stail+0x80ca3 @ 0x480ca3
stail+0x98cdb @ 0x498cdb
BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x757f33ca
RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x778d9ed2
RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x778d9ea5

exception.instruction_r: f7 37 89 06 e9 dd 07 00 00 8b 06 33 d2 8a 17 8b
exception.symbol: stail+0x3b5db
exception.instruction: div dword ptr [edi]
exception.module: stail.tmp
exception.exception_code: 0xc0000094
exception.offset: 243163
exception.address: 0x43b5db
registers.esp: 1637776
registers.edi: 10195132
registers.eax: 30017278
registers.ebp: 1637856
registers.edx: 0
registers.ebx: 1
registers.esi: 10195124
registers.ecx: 10195132
1 0 0
Time & API Arguments Status Return Repeated

NtProtectVirtualMemory

 process_identifier: 884
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x00400000
process_handle: 0xffffffff
1 0 0

NtProtectVirtualMemory

 process_identifier: 884
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 40960
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x00401000
process_handle: 0xffffffff
1 0 0

NtProtectVirtualMemory

 process_identifier: 884
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 20480
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x0040f000
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 1440
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x007b0000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 1236
region_size: 65536
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x00000000049d0000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffffffffffff
1 0 0
file C:\Users\test22\AppData\Local\Temp\is-N9G0C.tmp\_isetup\_iscrypt.dll
file C:\Users\test22\AppData\Local\Temp\is-N9G0C.tmp\_isetup\_shfoldr.dll
file C:\Users\test22\AppData\Local\Brekkiesoft Video Capture 1.22\brekkiesoftvideocapture.exe
file C:\Users\test22\AppData\Local\Temp\is-N9G0C.tmp\_isetup\_shfoldr.dll
file C:\Users\test22\AppData\Local\Temp\is-SVR9O.tmp\stail.tmp
file C:\Users\test22\AppData\Local\Temp\is-N9G0C.tmp\_isetup\_iscrypt.dll
Time & API Arguments Status Return Repeated

RegOpenKeyExA

 regkey_r: Software\Microsoft\Windows\CurrentVersion\Uninstall\Brekkiesoft Video Capture_is1
base_handle: 0x80000001
key_handle: 0x00000000
options: 0
access: 0x00000001
regkey: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Uninstall\Brekkiesoft Video Capture_is1
2 0

RegOpenKeyExA

 regkey_r: Software\Microsoft\Windows\CurrentVersion\Uninstall\Brekkiesoft Video Capture_is1
base_handle: 0x80000002
key_handle: 0x00000000
options: 0
access: 0x00000001
regkey: HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Uninstall\Brekkiesoft Video Capture_is1
2 0

RegOpenKeyExA

 regkey_r: Software\Microsoft\Windows\CurrentVersion\Uninstall\Brekkiesoft Video Capture_is1
base_handle: 0x80000001
key_handle: 0x00000000
options: 0
access: 0x00000008
regkey: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Uninstall\Brekkiesoft Video Capture_is1
2 0

RegOpenKeyExA

 regkey_r: Software\Microsoft\Windows\CurrentVersion\Uninstall\Brekkiesoft Video Capture_is1
base_handle: 0x80000002
key_handle: 0x00000000
options: 0
access: 0x00000008
regkey: HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Uninstall\Brekkiesoft Video Capture_is1
2 0
file C:\Users\test22\AppData\Local\Temp\is-SVR9O.tmp\stail.tmp
Bkav W32.AIDetectMalware
Lionic Trojan.Win32.Generic.4!c
Cynet Malicious (score: 99)
Cylance Unsafe
VIPRE Gen:Heur.Munp.1
Sangfor Dropper.Win32.Agent.V4ip
CrowdStrike win/malicious_confidence_100% (W)
BitDefender Gen:Heur.Munp.1
Arcabit Trojan.Munp.1
Symantec Trojan.Gen.MBT
Elastic malicious (moderate confidence)
ESET-NOD32 a variant of Win32/TrojanDropper.Agent.SLC
Avast FileRepMalware [Adw]
Kaspersky Trojan.Win32.Ekstak.azfve
Alibaba TrojanDropper:Win32/Generic.6f1d711a
MicroWorld-eScan Gen:Heur.Munp.1
Emsisoft Gen:Heur.Munp.1 (B)
F-Secure Heuristic.HEUR/AGEN.1375784
DrWeb Trojan.MulDrop26.51718
McAfeeD ti!5990FFF771E2
Trapmine malicious.moderate.ml.score
CTX exe.trojan.agen
Sophos Mal/Generic-S
FireEye Gen:Heur.Munp.1
Google Detected
Avira HEUR/AGEN.1375784
Kingsoft Win32.Troj.Undef.a
Gridinsoft Trojan.Win32.Agent.sa
Microsoft Trojan:Win32/Wacatac.B!ml
GData Win32.Trojan.Kryptik.B9V2TR
Varist W32/ABApplication.AUHC-0591
AhnLab-V3 Malware/Win.Generic.C5707400
McAfee Artemis!8E48644D626B
DeepInstinct MALICIOUS
Ikarus Trojan.Win32.Crypt
Tencent Win32.Trojan.Agen.Zwhl
huorong HEUR:TrojanDropper/Agent.t
Fortinet Riskware/Agent
AVG FileRepMalware [Adw]
Paloalto generic.ml