popup
Summary | ZeroBOX
  1. Home
  2. Result
  3. Report
  4. Detail Analysis

yoda.exe

Emotet Gen1 Generic Malware Malicious Library Antivirus UPX Malicious Packer Admin Tool (Sysinternals etc ...) Anti_VM dll MSOffice File PE File PE64 MZP Format OS Processor Check PE32 .NET DLL .NET EXE DLL DllRegisterServer
  1. Resubmit sample
Category Machine Started Completed
FILE s1_win7_x6401 Feb. 24, 2025, 12:02 p.m. Feb. 24, 2025, 12:04 p.m.
Size 14.0MB
Type PE32 executable (GUI) Intel 80386, for MS Windows
MD5 31c1980129a020ffd2836386ec757229
SHA256 b0094fc915f2cca6534fa7edc48ae1e400687e4aea032b9a6f0e626331b573cd
CRC32 271C01B6
ssdeep 393216:wv7qgAbFPfUbSo13Wdc0dLHnatlKYY43koRSYQQv:wvCFX0D5++KYY4QYQ2
Yara
  • Malicious_Library_Zero - Malicious_Library
  • PE_Header_Zero - PE File Signature
  • Antivirus - Contains references to security software
  • anti_vm_detect - Possibly employs anti-virtualization techniques
  • Win32_Trojan_Gen_1_0904B0_Zero - Win32 Trojan Emotet
  • Win32_Trojan_Emotet_2_Zero - Win32 Trojan Emotet
  • IsPE32 - (no description)
  • Generic_Malware_Zero - Generic Malware
  • OS_Processor_Check_Zero - OS Processor Check
  • mzp_file_format - MZP(Delphi) file format
  • UPX_Zero - UPX packed file

Name Response Post-Analysis Lookup
No hosts contacted.
IP Address Status Action
No hosts contacted.

Suricata Alerts

No Suricata Alerts

Suricata TLS

No Suricata TLS

Time & API Arguments Status Return Repeated

GetComputerNameW

 computer_name: TEST22-PC
1 1 0
Time & API Arguments Status Return Repeated

IsDebuggerPresent

 0 0

IsDebuggerPresent

 0 0

IsDebuggerPresent

 0 0
registry HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\MachineGuid
Time & API Arguments Status Return Repeated

GlobalMemoryStatusEx

 1 1 0
section .itext
Time & API Arguments Status Return Repeated

__exception__

 stacktrace: 
yoda+0xe2bed @ 0x4e2bed
yoda+0x1000fa @ 0x5000fa
BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x755c33ca
RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x76f49ed2
RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x76f49ea5

exception.instruction_r: c9 c2 10 00 cc cc cc cc cc 8b ff 55 8b ec 56 8b
exception.symbol: RaiseException+0x58 CloseHandle-0x9 kernelbase+0xb727
exception.instruction: leave
exception.module: KERNELBASE.dll
exception.exception_code: 0xeedfade
exception.offset: 46887
exception.address: 0x7597b727
registers.esp: 1637828
registers.edi: 4891672
registers.eax: 1637828
registers.ebp: 1637908
registers.edx: 0
registers.ebx: 5123053
registers.esi: 2
registers.ecx: 7
1 0 0
Time & API Arguments Status Return Repeated

NtProtectVirtualMemory

 process_identifier: 2540
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x00400000
process_handle: 0xffffffff
1 0 0

NtProtectVirtualMemory

 process_identifier: 2540
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 69632
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x00401000
process_handle: 0xffffffff
1 0 0

NtProtectVirtualMemory

 process_identifier: 2540
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 53248
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x0041b000
process_handle: 0xffffffff
1 0 0

NtProtectVirtualMemory

 process_identifier: 2540
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x73bc2000
process_handle: 0xffffffff
1 0 0

NtProtectVirtualMemory

 process_identifier: 2592
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x73bc2000
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2592
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x00540000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 1452
region_size: 65536
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x00000000046f0000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffffffffffff
1 0 0

NtProtectVirtualMemory

 process_identifier: 2720
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x00400000
process_handle: 0xffffffff
1 0 0

NtProtectVirtualMemory

 process_identifier: 2720
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 69632
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x00401000
process_handle: 0xffffffff
1 0 0

NtProtectVirtualMemory

 process_identifier: 2720
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 53248
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x0041b000
process_handle: 0xffffffff
1 0 0

NtProtectVirtualMemory

 process_identifier: 2720
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x74142000
process_handle: 0xffffffff
1 0 0

NtProtectVirtualMemory

 process_identifier: 2776
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x74142000
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2776
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x00680000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtProtectVirtualMemory

 process_identifier: 2956
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x74142000
process_handle: 0xffffffff
1 0 0
file C:\Users\test22\AppData\Local\Temp\is-GM7CA.tmp\_isetup\_shfoldr.dll
file C:\Users\test22\AppData\Local\Temp\is-GM7CA.tmp\_isetup\_iscrypt.dll
file C:\Users\test22\AppData\Local\Temp\is-QQ6O5.tmp\_isetup\_iscrypt.dll
file C:\Users\test22\AppData\Local\Temp\is-QQ6O5.tmp\_isetup\_shfoldr.dll
file C:\Users\test22\AppData\Local\Temp\is-IEI53.tmp\yoda.tmp
file C:\Users\test22\AppData\Local\Temp\is-QQ6O5.tmp\_isetup\_shfoldr.dll
file C:\Users\test22\AppData\Local\Temp\is-QQ6O5.tmp\_isetup\_iscrypt.dll
Time & API Arguments Status Return Repeated

ShellExecuteExW

 show_type: 0
filepath_r: C:\Users\test22\AppData\Local\Temp\yoda.exe
parameters: /VERYSILENT
filepath: C:\Users\test22\AppData\Local\Temp\yoda.exe
1 1 0
Time & API Arguments Status Return Repeated

Process32NextW

 snapshot_handle: 0x000001f4
process_name: pw.exe
process_identifier: 2316
1 1 0

Process32NextW

 snapshot_handle: 0x000001f4
process_name: taskhost.exe
process_identifier: 2364
1 1 0

Process32NextW

 snapshot_handle: 0x000001f4
process_name: yoda.exe
process_identifier: 2720
1 1 0

Process32NextW

 snapshot_handle: 0x000001f4
process_name: yoda.tmp
process_identifier: 2776
1 1 0

Process32NextW

 snapshot_handle: 0x00000124
process_name: AutoIt3.exe
process_identifier: 2956
1 1 0
Time & API Arguments Status Return Repeated

Process32NextW

 snapshot_handle: 0x000001f4
process_name: yoda.tmp
process_identifier: 2776
0 0

Process32NextW

 snapshot_handle: 0x000001f4
process_name: yoda.tmp
process_identifier: 2776
0 0

Process32NextW

 snapshot_handle: 0x000001f4
process_name: yoda.tmp
process_identifier: 2776
0 0

Process32NextW

 snapshot_handle: 0x000001f4
process_name: yoda.tmp
process_identifier: 2776
0 0

Process32NextW

 snapshot_handle: 0x000001f4
process_name: yoda.tmp
process_identifier: 2776
0 0

Process32NextW

 snapshot_handle: 0x00000124
process_name: AutoIt3.exe
process_identifier: 2956
0 0
Time & API Arguments Status Return Repeated

RegOpenKeyExW

 regkey_r: Software\Microsoft\Windows\CurrentVersion\Uninstall\Workshop_is1
base_handle: 0x80000001
key_handle: 0x00000000
options: 0
access: 0x00000001
regkey: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Uninstall\Workshop_is1
2 0

RegOpenKeyExW

 regkey_r: Software\Microsoft\Windows\CurrentVersion\Uninstall\Workshop_is1
base_handle: 0x80000002
key_handle: 0x00000000
options: 0
access: 0x00000001
regkey: HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Uninstall\Workshop_is1
2 0
reg_key HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\RunOnce\celloidin reg_value "C:\017bd04f-b3bf-45b6-8167-9e8f41ff87bf\Autoit3.exe" "C:\017bd04f-b3bf-45b6-8167-9e8f41ff87bf\celloidin.a3x"
Time & API Arguments Status Return Repeated

RegSetValueExW

 key_handle: 0x000001f0
regkey_r: RegFiles0000
reg_type: 7 (REG_MULTI_SZ)
value: C:\Users\test22\AppData\Roaming\{A225B959-A37A-4A90-A8CC-60F084F9DBA4}\7za.dllC:\Users\test22\AppData\Roaming\{A225B959-A37A-4A90-A8CC-60F084F9DBA4}\ACEEXCL.DLLC:\Users\test22\AppData\Roaming\{A225B959-A37A-4A90-A8CC-60F084F9DBA4}\aspnetcorev2_inprocess.dllC:\Users\test22\AppData\Roaming\{A225B959-A37A-4A90-A8CC-60F084F9DBA4}\cpfecl.Clang.Windows.arm64.dllC:\Users\test22\AppData\Roaming\{A225B959-A37A-4A90-A8CC-60F084F9DBA4}\CppDebug.resources.dllC:\Users\test22\AppData\Roaming\{A225B959-A37A-4A90-A8CC-60F084F9DBA4}\DiagnosticsHub.StandardCollector.Bridge.dllC:\Users\test22\AppData\Roaming\{A225B959-A37A-4A90-A8CC-60F084F9DBA4}\fputlsat.dllC:\Users\test22\AppData\Roaming\{A225B959-A37A-4A90-A8CC-60F084F9DBA4}\GpuProfilingAnalyzer.dllC:\Users\test22\AppData\Roaming\{A225B959-A37A-4A90-A8CC-60F084F9DBA4}\graphics-hook64.dllC:\Users\test22\AppData\Roaming\{A225B959-A37A-4A90-A8CC-60F084F9DBA4}\LdrtBurn64.dllC:\Users\test22\AppData\Roaming\{A225B959-A37A-4A90-A8CC-60F084F9DBA4}\libhogweed-6.dllC:\Users\test22\AppData\Roaming\{A225B959-A37A-4A90-A8CC-60F084F9DBA4}\Microsoft.Azure.Management.Monitor.Fluent.dllC:\Users\test22\AppData\Roaming\{A225B959-A37A-4A90-A8CC-60F084F9DBA4}\Microsoft.CodeAnalysis.VisualBasic.CodeStyle.Fixes.dllC:\Users\test22\AppData\Roaming\{A225B959-A37A-4A90-A8CC-60F084F9DBA4}\Microsoft.Office.BusinessData.dllC:\Users\test22\AppData\Roaming\{A225B959-A37A-4A90-A8CC-60F084F9DBA4}\Microsoft.VisualC.ProjectStore.Implementation.dllC:\Users\test22\AppData\Roaming\{A225B959-A37A-4A90-A8CC-60F084F9DBA4}\microsoft.visualstudio.graphics.dllC:\Users\test22\AppData\Roaming\{A225B959-A37A-4A90-A8CC-60F084F9DBA4}\Microsoft.VisualStudio.JavaScript.ProjectSystem.resources.dllC:\Users\test22\AppData\Roaming\{A225B959-A37A-4A90-A8CC-60F084F9DBA4}\Microsoft.VisualStudio.Shell.Framework.dllC:\Users\test22\AppData\Roaming\{A225B959-A37A-4A90-A8CC-60F084F9DBA4}\MicrosoftInstrumentationEngine_x86.dllC:\Users\test22\AppData\Roaming\{A225B959-A37A-4A90-A8CC-60F084F9DBA4}\mozwer.dllC:\Users\test22\AppData\Roaming\{A225B959-A37A-4A90-A8CC-60F084F9DBA4}\mp3lame.dllC:\Users\test22\AppData\Roaming\{A225B959-A37A-4A90-A8CC-60F084F9DBA4}\msenvico.dllC:\Users\test22\AppData\Roaming\{A225B959-A37A-4A90-A8CC-60F084F9DBA4}\msvcp100d.dllC:\Users\test22\AppData\Roaming\{A225B959-A37A-4A90-A8CC-60F084F9DBA4}\sqlcese35.dllC:\Users\test22\AppData\Roaming\{A225B959-A37A-4A90-A8CC-60F084F9DBA4}\System.Formats.Tar.dllC:\Users\test22\AppData\Roaming\{A225B959-A37A-4A90-A8CC-60F084F9DBA4}\System.IdentityModel.dllC:\Users\test22\AppData\Roaming\{A225B959-A37A-4A90-A8CC-60F084F9DBA4}\winfw.dllC:\Users\test22\AppData\Roaming\{A225B959-A37A-4A90-A8CC-60F084F9DBA4}\wxmsw32u_xrc_gcc_custom.dllC:\Users\test22\AppData\Roaming\{A225B959-A37A-4A90-A8CC-60F084F9DBA4}\bin\blocked-file-util.exeC:\Users\test22\AppData\Roaming\{A225B959-A37A-4A90-A8CC-60F084F9DBA4}\bin\bunzip2.exeC:\Users\test22\AppData\Roaming\{A225B959-A37A-4A90-A8CC-60F084F9DBA4}\bin\bzcat.exeC:\Users\test22\AppData\Roaming\{A225B959-A37A-4A90-A8CC-60F084F9DBA4}\bin\edit_test_dll.exeC:\Users\test22\AppData\Roaming\{A225B959-A37A-4A90-A8CC-60F084F9DBA4}\bin\gettext.exeC:\Users\test22\AppData\Roaming\{A225B959-A37A-4A90-A8CC-60F084F9DBA4}\bin\git-upload-archive.exeC:\Users\test22\AppData\Roaming\{A225B959-A37A-4A90-A8CC-60F084F9DBA4}\bin\klist.exeC:\Users\test22\AppData\Roaming\{A225B959-A37A-4A90-A8CC-60F084F9DBA4}\bin\kvno.exeC:\Users\test22\AppData\Roaming\{A225B959-A37A-4A90-A8CC-60F084F9DBA4}\bin\mit2ms.exeC:\Users\test22\AppData\Roaming\{A225B959-A37A-4A90-A8CC-60F084F9DBA4}\bin\tclsh.exeC:\Users\test22\AppData\Roaming\{A225B959-A37A-4A90-A8CC-60F084F9DBA4}\bin\wish86.exeC:\Users\test22\AppData\Roaming\{A225B959-A37A-4A90-A8CC-60F084F9DBA4}\Lib\antiword.exeC:\Users\test22\AppData\Roaming\{A225B959-A37A-4A90-A8CC-60F084F9DBA4}\Lib\blocked-file-util.exeC:\Users\test22\AppData\Roaming\{A225B959-A37A-4A90-A8CC-60F084F9DBA4}\Lib\git-askpass.exeC:\Users\test22\AppData\Roaming\{A225B959-A37A-4A90-A8CC-60F084F9DBA4}\Lib\git-askyesno.exeC:\Users\test22\AppData\Roaming\{A225B959-A37A-4A90-A8CC-60F084F9DBA4}\Lib\GitLab.UI.exeC:\Users\test22\AppData\Roaming\{A225B959-A37A-4A90-A8CC-60F084F9DBA4}\Lib\gss-client.exeC:\Users\test22\AppData\Roaming\{A225B959-A37A-4A90-A8CC-60F084F9DBA4}\Lib\kinit.exeC:\Users\test22\AppData\Roaming\{A225B959-A37A-4A90-A8CC-60F084F9DBA4}\Lib\kvno.exeC:\Users\test22\AppData\Roaming\{A225B959-A37A-4A90-A8CC-60F084F9DBA4}\Lib\lzmadec.exeC:\Users\test22\AppData\Roaming\{A225B959-A37A-4A90-A8CC-60F084F9DBA4}\Lib\xz.exeC:\Users\test22\AppData\Roaming\{A225B959-A37A-4A90-A8CC-60F084F9DBA4}\AutoIt3.exe
regkey: HKEY_CURRENT_USER\Software\Microsoft\RestartManager\Session0000\RegFiles0000
1 0 0
Bkav W32.AIDetectMalware
Elastic malicious (moderate confidence)
Kaspersky UDS:Trojan.Win32.Autoit.acrut
McAfeeD ti!B0094FC915F2
Kingsoft Win32.Troj.Undef.a
Microsoft Trojan:Win32/Phonzy.B!ml
McAfee Artemis!31C1980129A0
DeepInstinct MALICIOUS
Ikarus Trojan-Spy.Win32.LummaStealer
Fortinet Malicious_Behavior.SB
CrowdStrike win/grayware_confidence_100% (D)