popup
Summary | ZeroBOX
  1. Home
  2. Result
  3. Report
  4. Detail Analysis

KX7TDcm.exe

Emotet Gen1 Malicious Library UPX AntiDebug PE64 PE File CAB AntiVM
  1. Resubmit sample
Category Machine Started Completed
FILE s1_win7_x6403_us March 20, 2025, 9:59 a.m. March 20, 2025, 10:05 a.m.
Size 158.5KB
Type PE32+ executable (GUI) x86-64, for MS Windows
MD5 b3ed4a5d880de0e32a6e2a886cc03d9b
SHA256 24ebbd5c8625e4819eaafb2f7350be565cc1048fcef9eb4ea86921f261b88ddb
CRC32 B868740A
ssdeep 3072:+ahKyd2n31r5GWp1icKAArDZz4N9GhbkrNEk1ftT:+ahOrp0yN90QE81
PDB Path wextract.pdb
Yara
  • Malicious_Library_Zero - Malicious_Library
  • PE_Header_Zero - PE File Signature
  • IsPE64 - (no description)
  • Win32_Trojan_Emotet_RL_Gen_Zero - Win32 Trojan Emotet
  • CAB_file_format - CAB archive file
  • Win32_Trojan_Gen_1_0904B0_Zero - Win32 Trojan Emotet
  • UPX_Zero - UPX packed file

Name Response Post-Analysis Lookup
No hosts contacted.
IP Address Status Action
No hosts contacted.

Suricata Alerts

No Suricata Alerts

Suricata TLS

No Suricata TLS

Time & API Arguments Status Return Repeated

GetComputerNameW

 computer_name: TEST22-PC
1 1 0
Time & API Arguments Status Return Repeated

IsDebuggerPresent

 0 0
registry HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\MachineGuid
pdb_path wextract.pdb
Time & API Arguments Status Return Repeated

GlobalMemoryStatusEx

 1 1 0
resource name AVI
file C:\Users\test22\AppData\Local\Temp\IXP000.TMP\67da233bc0788.vbs
cmdline cmd.exe /c 67da233bc0788.vbs
section {u'size_of_data': u'0x0001ca00', u'virtual_address': u'0x0000f000', u'entropy': 7.03516476275183, u'name': u'.rsrc', u'virtual_size': u'0x0001d000'} entropy 7.03516476275 description A section with a high entropy has been found
entropy 0.726984126984 description Overall entropy of this PE file is high
description (no description) rule DebuggerCheck__GlobalFlags
description (no description) rule DebuggerCheck__QueryInfo
description (no description) rule DebuggerHiding__Thread
description (no description) rule DebuggerHiding__Active
description (no description) rule ThreadControl__Context
description (no description) rule SEH__vectored
description Checks if being debugged rule anti_dbg
description Bypass DEP rule disable_dep
reg_key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 reg_value rundll32.exe C:\Windows\system32\advpack.dll,DelNodeRunDLL32 "C:\Users\test22\AppData\Local\Temp\IXP000.TMP\"
file C:\Users\test22\AppData\Local\Temp\IXP000.TMP\67da233bc0788.vbs
Process injection Process 1372 resumed a thread in remote process 2256
Time & API Arguments Status Return Repeated

NtResumeThread

 thread_handle: 0x000000000000028c
suspend_count: 1
process_identifier: 2256
1 0 0
Lionic Trojan.Win32.Generic.4!c
Skyhigh BehavesLike.Win64.Downloader.ch
Cylance Unsafe
CrowdStrike win/malicious_confidence_60% (W)
Symantec ML.Attribute.HighConfidence
Elastic malicious (high confidence)
ESET-NOD32 a variant of Generik.KOSITFU
APEX Malicious
Avast Script:SNH-gen [Trj]
Kaspersky UDS:DangerousObject.Multi.Generic
Rising Downloader.GuLoader/VBS!1.12749 (CLASSIC)
DrWeb VBS.DownLoader.3511
TrendMicro Trojan.Win64.AMADEY.YXFCSZ
McAfeeD ti!24EBBD5C8625
CTX exe.trojan.bearfoos
Sophos Mal/Generic-S
Ikarus Trojan.VBS.Agent
Webroot W32.Trojan.Genkd
Google Detected
Antiy-AVL Trojan/Win32.Bearfoos
Microsoft Trojan:Win32/Wacatac.B!ml
GData Win64.Trojan.Agent.WM0ES8
Varist W64/Agent.GIK.gen!Eldorado
McAfee Artemis!B3ED4A5D880D
DeepInstinct MALICIOUS
Panda Trj/Chgt.AD
TrendMicro-HouseCall Trojan.Win64.AMADEY.YXFCSZ
huorong Trojan/VBS.GuLoader.ar
MaxSecure Trojan.Malware.300983.susgen
Fortinet W32/PossibleThreat
AVG Script:SNH-gen [Trj]
alibabacloud Trojan:Multi/Bearfoos.B9nj