Summary | ZeroBOX

Category	Machine	Started	Completed
FILE	s1_win7_x6401	March 11, 2021, 6:28 p.m.	March 11, 2021, 6:29 p.m.

Size	506.0KB
Type	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
MD5	`39c4c83a789474b9f1d981164eded0bd`
SHA256	`44db0c8da11873d9c09e12edacb7548cc311ff154dafcef3c14279c93f7b0339`
CRC32	`5639735C`
ssdeep	`6144:0sStWdMjzXIMROe6sywNsY2lde2KK3Q6lDVtDY/3I+q3:RStsmQe6sxs7ld7BPf44+y`
PDB Path	c:\GoneWinter\TrackState\Mapheat\sectionHeard\made.pdb
Yara	PE_Header_Zero - PE File Signature Zero Win32_Trojan_Gen_2_0904B0_Zero - Win32 Trojan Gen win_files_operation - Affect private profile Win32_Trojan_Gen_1_0904B0_Zero - Win32 Trojan Emotet IsPE32 - (no description) IsDLL - (no description) IsWindowsGUI - (no description) HasOverlay - Overlay Check HasDigitalSignature - DigitalSignature Check HasDebugData - DebugData Check HasRichSignature - Rich Signature Check

rundll32.exe "C:\Windows\System32\rundll32.exe" C:\Users\test22\AppData\Local\Temp\44265.9599178241.dat.dll,_DllRegisterServer@0
1896
rundll32.exe "C:\Windows\System32\rundll32.exe" C:\Users\test22\AppData\Local\Temp\44265.9599178241.dat.dll,_Industrystick@8
2428
rundll32.exe "C:\Windows\System32\rundll32.exe" C:\Users\test22\AppData\Local\Temp\44265.9599178241.dat.dll,_Repeatbroke@4
2624
rundll32.exe "C:\Windows\System32\rundll32.exe" C:\Users\test22\AppData\Local\Temp\44265.9599178241.dat.dll,
2772

Name	Response	Post-Analysis Lookup
No hosts contacted.

IP Address	Status	Action
No hosts contacted.

No Suricata Alerts

No Suricata TLS

pdb_path

c:\GoneWinter\TrackState\Mapheat\sectionHeard\made.pdb

Time & API	Arguments	Status
NtProtectVirtualMemory March 11, 2021, 6:28 p.m.	process_identifier: 1896 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0043a000 process_handle: 0xffffffff	1
NtProtectVirtualMemory March 11, 2021, 6:28 p.m.	process_identifier: 1896 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x73d71000 process_handle: 0xffffffff	1
NtProtectVirtualMemory March 11, 2021, 6:28 p.m.	process_identifier: 2428 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x007fa000 process_handle: 0xffffffff	1
NtProtectVirtualMemory March 11, 2021, 6:28 p.m.	process_identifier: 2428 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x73d71000 process_handle: 0xffffffff	1
NtProtectVirtualMemory March 11, 2021, 6:28 p.m.	process_identifier: 2624 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x003ea000 process_handle: 0xffffffff	1
NtProtectVirtualMemory March 11, 2021, 6:28 p.m.	process_identifier: 2624 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x73d71000 process_handle: 0xffffffff	1

44265.9599178241.dat