Summary | ZeroBOX

Category	Machine	Started	Completed
FILE	s1_win7_x6402	March 23, 2021, 6:06 p.m.	March 23, 2021, 6:10 p.m.

Size	373.5KB
Type	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
MD5	`8abd17bb45aaf7ded8caa930b60d38ef`
SHA256	`ced88a781a18875bea55ccbf9dcc043cb400bd2c3f35afed8b0a6a2f33290991`
CRC32	`B3FA35BE`
ssdeep	`6144:bazDDMR7/G47LrVk7gGKLtfV55dg4jPdU1eSWbj8:biAR7/GkOnkttzdU1el8`
PDB Path	c:\Bet\ee-whe\her\rollClose\heartplan\Answerlong\bank.pdb
Yara	Win32_Trojan_Gen_2_0904B0_Zero - Win32 Trojan Gen PE_Header_Zero - PE File Signature Zero OS_Processor_Check_Zero - OS Processor Check Signature Zero win_files_operation - Affect private profile IsPE32 - (no description) IsDLL - (no description) IsWindowsGUI - (no description) HasDebugData - DebugData Check HasRichSignature - Rich Signature Check

rundll32.exe "C:\Windows\System32\rundll32.exe" C:\Users\test22\AppData\Local\Temp\e5lojgiow.tar.dll,Cutmass
7180
rundll32.exe "C:\Windows\System32\rundll32.exe" C:\Users\test22\AppData\Local\Temp\e5lojgiow.tar.dll,Middlewall
4356
rundll32.exe "C:\Windows\System32\rundll32.exe" C:\Users\test22\AppData\Local\Temp\e5lojgiow.tar.dll,
9076

Name	Response	Post-Analysis Lookup
No hosts contacted.

IP Address	Status	Action
172.217.25.14	Active	Moloch

Suricata Alerts

No Suricata Alerts

Suricata TLS

No Suricata TLS

This executable has a PDB path (1 event)

pdb_path

c:\Bet\ee-whe\her\rollClose\heartplan\Answerlong\bank.pdb

One or more processes crashed (50 out of 70 events)

Time & API	Arguments	Status
__exception__ March 23, 2021, 6:07 p.m.	stacktrace: exception.instruction_r: cc c3 5d c3 33 c0 5d c3 68 e0 7d b6 c0 68 ea b3 exception.instruction: int3 exception.exception_code: 0x80000003 exception.symbol: DllRegisterServer+0x72ec e5lojgiow+0x1105c exception.address: 0x7221105c registers.esp: 1044412 registers.edi: 6695896 registers.eax: 2000478246 registers.ebp: 2000552521 registers.edx: 129161 registers.ebx: 2704346981 registers.esi: 1970405376 registers.ecx: 66040	1
__exception__ March 23, 2021, 6:07 p.m.	stacktrace: exception.instruction_r: cc c3 5d c3 33 c0 5d c3 68 e0 7d b6 c0 68 ea b3 exception.instruction: int3 exception.exception_code: 0x80000003 exception.symbol: DllRegisterServer+0x72ec e5lojgiow+0x1105c exception.address: 0x7221105c registers.esp: 1044388 registers.edi: 16 registers.eax: 2000478246 registers.ebp: 32180176 registers.edx: 0 registers.ebx: 0 registers.esi: 64 registers.ecx: 0	1
__exception__ March 23, 2021, 6:07 p.m.	stacktrace: exception.instruction_r: cc c3 5d c3 33 c0 5d c3 68 e0 7d b6 c0 68 ea b3 exception.instruction: int3 exception.exception_code: 0x80000003 exception.symbol: DllRegisterServer+0x72ec e5lojgiow+0x1105c exception.address: 0x7221105c registers.esp: 1044388 registers.edi: 15 registers.eax: 2000478246 registers.ebp: 32180192 registers.edx: 0 registers.ebx: 0 registers.esi: 64 registers.ecx: 0	1
__exception__ March 23, 2021, 6:07 p.m.	stacktrace: exception.instruction_r: cc c3 5d c3 33 c0 5d c3 68 e0 7d b6 c0 68 ea b3 exception.instruction: int3 exception.exception_code: 0x80000003 exception.symbol: DllRegisterServer+0x72ec e5lojgiow+0x1105c exception.address: 0x7221105c registers.esp: 1044388 registers.edi: 14 registers.eax: 2000478246 registers.ebp: 32180208 registers.edx: 0 registers.ebx: 0 registers.esi: 64 registers.ecx: 0	1
__exception__ March 23, 2021, 6:07 p.m.	stacktrace: exception.instruction_r: cc c3 5d c3 33 c0 5d c3 68 e0 7d b6 c0 68 ea b3 exception.instruction: int3 exception.exception_code: 0x80000003 exception.symbol: DllRegisterServer+0x72ec e5lojgiow+0x1105c exception.address: 0x7221105c registers.esp: 1044388 registers.edi: 13 registers.eax: 2000478246 registers.ebp: 32180224 registers.edx: 0 registers.ebx: 0 registers.esi: 64 registers.ecx: 0	1
__exception__ March 23, 2021, 6:07 p.m.	stacktrace: exception.instruction_r: cc c3 5d c3 33 c0 5d c3 68 e0 7d b6 c0 68 ea b3 exception.instruction: int3 exception.exception_code: 0x80000003 exception.symbol: DllRegisterServer+0x72ec e5lojgiow+0x1105c exception.address: 0x7221105c registers.esp: 1044388 registers.edi: 12 registers.eax: 2000478246 registers.ebp: 32180240 registers.edx: 0 registers.ebx: 0 registers.esi: 64 registers.ecx: 0	1
__exception__ March 23, 2021, 6:07 p.m.	stacktrace: exception.instruction_r: cc c3 5d c3 33 c0 5d c3 68 e0 7d b6 c0 68 ea b3 exception.instruction: int3 exception.exception_code: 0x80000003 exception.symbol: DllRegisterServer+0x72ec e5lojgiow+0x1105c exception.address: 0x7221105c registers.esp: 1044388 registers.edi: 11 registers.eax: 2000478246 registers.ebp: 32180256 registers.edx: 0 registers.ebx: 0 registers.esi: 64 registers.ecx: 0	1
__exception__ March 23, 2021, 6:07 p.m.	stacktrace: exception.instruction_r: cc c3 5d c3 33 c0 5d c3 68 e0 7d b6 c0 68 ea b3 exception.instruction: int3 exception.exception_code: 0x80000003 exception.symbol: DllRegisterServer+0x72ec e5lojgiow+0x1105c exception.address: 0x7221105c registers.esp: 1044388 registers.edi: 10 registers.eax: 2000478246 registers.ebp: 32180272 registers.edx: 0 registers.ebx: 0 registers.esi: 64 registers.ecx: 0	1
__exception__ March 23, 2021, 6:07 p.m.	stacktrace: exception.instruction_r: cc c3 5d c3 33 c0 5d c3 68 e0 7d b6 c0 68 ea b3 exception.instruction: int3 exception.exception_code: 0x80000003 exception.symbol: DllRegisterServer+0x72ec e5lojgiow+0x1105c exception.address: 0x7221105c registers.esp: 1044388 registers.edi: 9 registers.eax: 2000478246 registers.ebp: 32180288 registers.edx: 0 registers.ebx: 0 registers.esi: 64 registers.ecx: 0	1
__exception__ March 23, 2021, 6:07 p.m.	stacktrace: exception.instruction_r: cc c3 5d c3 33 c0 5d c3 68 e0 7d b6 c0 68 ea b3 exception.instruction: int3 exception.exception_code: 0x80000003 exception.symbol: DllRegisterServer+0x72ec e5lojgiow+0x1105c exception.address: 0x7221105c registers.esp: 1044388 registers.edi: 8 registers.eax: 2000478246 registers.ebp: 32180304 registers.edx: 0 registers.ebx: 0 registers.esi: 64 registers.ecx: 0	1
__exception__ March 23, 2021, 6:07 p.m.	stacktrace: exception.instruction_r: cc c3 5d c3 33 c0 5d c3 68 e0 7d b6 c0 68 ea b3 exception.instruction: int3 exception.exception_code: 0x80000003 exception.symbol: DllRegisterServer+0x72ec e5lojgiow+0x1105c exception.address: 0x7221105c registers.esp: 1044388 registers.edi: 7 registers.eax: 2000478246 registers.ebp: 32180320 registers.edx: 0 registers.ebx: 0 registers.esi: 64 registers.ecx: 0	1
__exception__ March 23, 2021, 6:07 p.m.	stacktrace: exception.instruction_r: cc c3 5d c3 33 c0 5d c3 68 e0 7d b6 c0 68 ea b3 exception.instruction: int3 exception.exception_code: 0x80000003 exception.symbol: DllRegisterServer+0x72ec e5lojgiow+0x1105c exception.address: 0x7221105c registers.esp: 1044388 registers.edi: 6 registers.eax: 2000478246 registers.ebp: 32180336 registers.edx: 0 registers.ebx: 0 registers.esi: 64 registers.ecx: 0	1
__exception__ March 23, 2021, 6:07 p.m.	stacktrace: exception.instruction_r: cc c3 5d c3 33 c0 5d c3 68 e0 7d b6 c0 68 ea b3 exception.instruction: int3 exception.exception_code: 0x80000003 exception.symbol: DllRegisterServer+0x72ec e5lojgiow+0x1105c exception.address: 0x7221105c registers.esp: 1044388 registers.edi: 5 registers.eax: 2000478246 registers.ebp: 32180352 registers.edx: 0 registers.ebx: 0 registers.esi: 64 registers.ecx: 0	1
__exception__ March 23, 2021, 6:07 p.m.	stacktrace: exception.instruction_r: cc c3 5d c3 33 c0 5d c3 68 e0 7d b6 c0 68 ea b3 exception.instruction: int3 exception.exception_code: 0x80000003 exception.symbol: DllRegisterServer+0x72ec e5lojgiow+0x1105c exception.address: 0x7221105c registers.esp: 1044388 registers.edi: 4 registers.eax: 2000478246 registers.ebp: 32180368 registers.edx: 0 registers.ebx: 0 registers.esi: 64 registers.ecx: 0	1
__exception__ March 23, 2021, 6:07 p.m.	stacktrace: exception.instruction_r: cc c3 5d c3 33 c0 5d c3 68 e0 7d b6 c0 68 ea b3 exception.instruction: int3 exception.exception_code: 0x80000003 exception.symbol: DllRegisterServer+0x72ec e5lojgiow+0x1105c exception.address: 0x7221105c registers.esp: 1044388 registers.edi: 3 registers.eax: 2000478246 registers.ebp: 32180384 registers.edx: 0 registers.ebx: 0 registers.esi: 64 registers.ecx: 0	1
__exception__ March 23, 2021, 6:07 p.m.	stacktrace: exception.instruction_r: cc c3 5d c3 33 c0 5d c3 68 e0 7d b6 c0 68 ea b3 exception.instruction: int3 exception.exception_code: 0x80000003 exception.symbol: DllRegisterServer+0x72ec e5lojgiow+0x1105c exception.address: 0x7221105c registers.esp: 1044388 registers.edi: 2 registers.eax: 2000478246 registers.ebp: 32180400 registers.edx: 0 registers.ebx: 0 registers.esi: 64 registers.ecx: 0	1
__exception__ March 23, 2021, 6:07 p.m.	stacktrace: exception.instruction_r: cc c3 5d c3 33 c0 5d c3 68 e0 7d b6 c0 68 ea b3 exception.instruction: int3 exception.exception_code: 0x80000003 exception.symbol: DllRegisterServer+0x72ec e5lojgiow+0x1105c exception.address: 0x7221105c registers.esp: 1044388 registers.edi: 1 registers.eax: 2000478246 registers.ebp: 32180416 registers.edx: 0 registers.ebx: 0 registers.esi: 64 registers.ecx: 0	1
__exception__ March 23, 2021, 6:07 p.m.	stacktrace: DllRegisterServer+0xcbc7 e5lojgiow+0x16937 @ 0x72216937 exception.instruction_r: cc c3 5d c3 33 c0 5d c3 68 e0 7d b6 c0 68 ea b3 exception.instruction: int3 exception.exception_code: 0x80000003 exception.symbol: DllRegisterServer+0x72ec e5lojgiow+0x1105c exception.address: 0x7221105c registers.esp: 1043592 registers.edi: 12 registers.eax: 2000478246 registers.ebp: 1044656 registers.edx: 23 registers.ebx: 1044672 registers.esi: 23 registers.ecx: 0	1
__exception__ March 23, 2021, 6:07 p.m.	stacktrace: exception.instruction_r: cc c3 5d c3 33 c0 5d c3 68 e0 7d b6 c0 68 ea b3 exception.instruction: int3 exception.exception_code: 0x80000003 exception.symbol: DllRegisterServer+0x72ec e5lojgiow+0x1105c exception.address: 0x7221105c registers.esp: 1044640 registers.edi: 6 registers.eax: 2000478246 registers.ebp: 96784 registers.edx: 827898 registers.ebx: 0 registers.esi: 282 registers.ecx: 0	1
__exception__ March 23, 2021, 6:07 p.m.	stacktrace: exception.instruction_r: cc c3 5d c3 33 c0 5d c3 68 e0 7d b6 c0 68 ea b3 exception.instruction: int3 exception.exception_code: 0x80000003 exception.symbol: DllRegisterServer+0x72ec e5lojgiow+0x1105c exception.address: 0x7221105c registers.esp: 1044616 registers.edi: 6 registers.eax: 2000478246 registers.ebp: 16 registers.edx: 0 registers.ebx: 64 registers.esi: 32183656 registers.ecx: 0	1
__exception__ March 23, 2021, 6:07 p.m.	stacktrace: exception.instruction_r: cc c3 5d c3 33 c0 5d c3 68 e0 7d b6 c0 68 ea b3 exception.instruction: int3 exception.exception_code: 0x80000003 exception.symbol: DllRegisterServer+0x72ec e5lojgiow+0x1105c exception.address: 0x7221105c registers.esp: 1044616 registers.edi: 6 registers.eax: 2000478246 registers.ebp: 15 registers.edx: 0 registers.ebx: 64 registers.esi: 32183680 registers.ecx: 0	1
__exception__ March 23, 2021, 6:07 p.m.	stacktrace: exception.instruction_r: cc c3 5d c3 33 c0 5d c3 68 e0 7d b6 c0 68 ea b3 exception.instruction: int3 exception.exception_code: 0x80000003 exception.symbol: DllRegisterServer+0x72ec e5lojgiow+0x1105c exception.address: 0x7221105c registers.esp: 1044616 registers.edi: 6 registers.eax: 2000478246 registers.ebp: 14 registers.edx: 0 registers.ebx: 64 registers.esi: 32183704 registers.ecx: 0	1
__exception__ March 23, 2021, 6:07 p.m.	stacktrace: exception.instruction_r: cc c3 5d c3 33 c0 5d c3 68 e0 7d b6 c0 68 ea b3 exception.instruction: int3 exception.exception_code: 0x80000003 exception.symbol: DllRegisterServer+0x72ec e5lojgiow+0x1105c exception.address: 0x7221105c registers.esp: 1044616 registers.edi: 6 registers.eax: 2000478246 registers.ebp: 13 registers.edx: 0 registers.ebx: 64 registers.esi: 32183728 registers.ecx: 0	1
__exception__ March 23, 2021, 6:07 p.m.	stacktrace: exception.instruction_r: cc c3 5d c3 33 c0 5d c3 68 e0 7d b6 c0 68 ea b3 exception.instruction: int3 exception.exception_code: 0x80000003 exception.symbol: DllRegisterServer+0x72ec e5lojgiow+0x1105c exception.address: 0x7221105c registers.esp: 1044616 registers.edi: 6 registers.eax: 2000478246 registers.ebp: 12 registers.edx: 0 registers.ebx: 64 registers.esi: 32183752 registers.ecx: 0	1
__exception__ March 23, 2021, 6:07 p.m.	stacktrace: exception.instruction_r: cc c3 5d c3 33 c0 5d c3 68 e0 7d b6 c0 68 ea b3 exception.instruction: int3 exception.exception_code: 0x80000003 exception.symbol: DllRegisterServer+0x72ec e5lojgiow+0x1105c exception.address: 0x7221105c registers.esp: 1044616 registers.edi: 6 registers.eax: 2000478246 registers.ebp: 11 registers.edx: 0 registers.ebx: 64 registers.esi: 32183776 registers.ecx: 0	1
__exception__ March 23, 2021, 6:07 p.m.	stacktrace: exception.instruction_r: cc c3 5d c3 33 c0 5d c3 68 e0 7d b6 c0 68 ea b3 exception.instruction: int3 exception.exception_code: 0x80000003 exception.symbol: DllRegisterServer+0x72ec e5lojgiow+0x1105c exception.address: 0x7221105c registers.esp: 1044616 registers.edi: 6 registers.eax: 2000478246 registers.ebp: 10 registers.edx: 0 registers.ebx: 64 registers.esi: 32183800 registers.ecx: 0	1
__exception__ March 23, 2021, 6:07 p.m.	stacktrace: exception.instruction_r: cc c3 5d c3 33 c0 5d c3 68 e0 7d b6 c0 68 ea b3 exception.instruction: int3 exception.exception_code: 0x80000003 exception.symbol: DllRegisterServer+0x72ec e5lojgiow+0x1105c exception.address: 0x7221105c registers.esp: 1044616 registers.edi: 6 registers.eax: 2000478246 registers.ebp: 9 registers.edx: 0 registers.ebx: 64 registers.esi: 32183824 registers.ecx: 0	1
__exception__ March 23, 2021, 6:07 p.m.	stacktrace: exception.instruction_r: cc c3 5d c3 33 c0 5d c3 68 e0 7d b6 c0 68 ea b3 exception.instruction: int3 exception.exception_code: 0x80000003 exception.symbol: DllRegisterServer+0x72ec e5lojgiow+0x1105c exception.address: 0x7221105c registers.esp: 1044616 registers.edi: 6 registers.eax: 2000478246 registers.ebp: 8 registers.edx: 0 registers.ebx: 64 registers.esi: 32183848 registers.ecx: 0	1
__exception__ March 23, 2021, 6:07 p.m.	stacktrace: exception.instruction_r: cc c3 5d c3 33 c0 5d c3 68 e0 7d b6 c0 68 ea b3 exception.instruction: int3 exception.exception_code: 0x80000003 exception.symbol: DllRegisterServer+0x72ec e5lojgiow+0x1105c exception.address: 0x7221105c registers.esp: 1044616 registers.edi: 6 registers.eax: 2000478246 registers.ebp: 7 registers.edx: 0 registers.ebx: 64 registers.esi: 32183872 registers.ecx: 0	1
__exception__ March 23, 2021, 6:07 p.m.	stacktrace: exception.instruction_r: cc c3 5d c3 33 c0 5d c3 68 e0 7d b6 c0 68 ea b3 exception.instruction: int3 exception.exception_code: 0x80000003 exception.symbol: DllRegisterServer+0x72ec e5lojgiow+0x1105c exception.address: 0x7221105c registers.esp: 1044616 registers.edi: 6 registers.eax: 2000478246 registers.ebp: 6 registers.edx: 0 registers.ebx: 64 registers.esi: 32183896 registers.ecx: 0	1
__exception__ March 23, 2021, 6:07 p.m.	stacktrace: exception.instruction_r: cc c3 5d c3 33 c0 5d c3 68 e0 7d b6 c0 68 ea b3 exception.instruction: int3 exception.exception_code: 0x80000003 exception.symbol: DllRegisterServer+0x72ec e5lojgiow+0x1105c exception.address: 0x7221105c registers.esp: 1044616 registers.edi: 6 registers.eax: 2000478246 registers.ebp: 5 registers.edx: 0 registers.ebx: 64 registers.esi: 32183920 registers.ecx: 0	1
__exception__ March 23, 2021, 6:07 p.m.	stacktrace: exception.instruction_r: cc c3 5d c3 33 c0 5d c3 68 e0 7d b6 c0 68 ea b3 exception.instruction: int3 exception.exception_code: 0x80000003 exception.symbol: DllRegisterServer+0x72ec e5lojgiow+0x1105c exception.address: 0x7221105c registers.esp: 1044616 registers.edi: 6 registers.eax: 2000478246 registers.ebp: 4 registers.edx: 0 registers.ebx: 64 registers.esi: 32183944 registers.ecx: 0	1
__exception__ March 23, 2021, 6:07 p.m.	stacktrace: exception.instruction_r: cc c3 5d c3 33 c0 5d c3 68 e0 7d b6 c0 68 ea b3 exception.instruction: int3 exception.exception_code: 0x80000003 exception.symbol: DllRegisterServer+0x72ec e5lojgiow+0x1105c exception.address: 0x7221105c registers.esp: 1044616 registers.edi: 6 registers.eax: 2000478246 registers.ebp: 3 registers.edx: 0 registers.ebx: 64 registers.esi: 32183968 registers.ecx: 0	1
__exception__ March 23, 2021, 6:07 p.m.	stacktrace: exception.instruction_r: cc c3 5d c3 33 c0 5d c3 68 e0 7d b6 c0 68 ea b3 exception.instruction: int3 exception.exception_code: 0x80000003 exception.symbol: DllRegisterServer+0x72ec e5lojgiow+0x1105c exception.address: 0x7221105c registers.esp: 1044616 registers.edi: 6 registers.eax: 2000478246 registers.ebp: 2 registers.edx: 0 registers.ebx: 64 registers.esi: 32183992 registers.ecx: 0	1
__exception__ March 23, 2021, 6:07 p.m.	stacktrace: exception.instruction_r: cc c3 5d c3 33 c0 5d c3 68 e0 7d b6 c0 68 ea b3 exception.instruction: int3 exception.exception_code: 0x80000003 exception.symbol: DllRegisterServer+0x72ec e5lojgiow+0x1105c exception.address: 0x7221105c registers.esp: 1044616 registers.edi: 6 registers.eax: 2000478246 registers.ebp: 1 registers.edx: 0 registers.ebx: 64 registers.esi: 32184016 registers.ecx: 0	1
__exception__ March 23, 2021, 6:07 p.m.	stacktrace: exception.instruction_r: cc c3 5d c3 33 c0 5d c3 68 e0 7d b6 c0 68 ea b3 exception.instruction: int3 exception.exception_code: 0x80000003 exception.symbol: DllRegisterServer+0x72ec e5lojgiow+0x1105c exception.address: 0x7221105c registers.esp: 2552292 registers.edi: 6040552 registers.eax: 2000478246 registers.ebp: 2000552521 registers.edx: 129161 registers.ebx: 2704346981 registers.esi: 1970405376 registers.ecx: 66040	1
__exception__ March 23, 2021, 6:07 p.m.	stacktrace: exception.instruction_r: cc c3 5d c3 33 c0 5d c3 68 e0 7d b6 c0 68 ea b3 exception.instruction: int3 exception.exception_code: 0x80000003 exception.symbol: DllRegisterServer+0x72ec e5lojgiow+0x1105c exception.address: 0x7221105c registers.esp: 2552268 registers.edi: 16 registers.eax: 2000478246 registers.ebp: 33490896 registers.edx: 0 registers.ebx: 0 registers.esi: 64 registers.ecx: 0	1
__exception__ March 23, 2021, 6:07 p.m.	stacktrace: exception.instruction_r: cc c3 5d c3 33 c0 5d c3 68 e0 7d b6 c0 68 ea b3 exception.instruction: int3 exception.exception_code: 0x80000003 exception.symbol: DllRegisterServer+0x72ec e5lojgiow+0x1105c exception.address: 0x7221105c registers.esp: 2552268 registers.edi: 15 registers.eax: 2000478246 registers.ebp: 33490912 registers.edx: 0 registers.ebx: 0 registers.esi: 64 registers.ecx: 0	1
__exception__ March 23, 2021, 6:07 p.m.	stacktrace: exception.instruction_r: cc c3 5d c3 33 c0 5d c3 68 e0 7d b6 c0 68 ea b3 exception.instruction: int3 exception.exception_code: 0x80000003 exception.symbol: DllRegisterServer+0x72ec e5lojgiow+0x1105c exception.address: 0x7221105c registers.esp: 2552268 registers.edi: 14 registers.eax: 2000478246 registers.ebp: 33490928 registers.edx: 0 registers.ebx: 0 registers.esi: 64 registers.ecx: 0	1
__exception__ March 23, 2021, 6:07 p.m.	stacktrace: exception.instruction_r: cc c3 5d c3 33 c0 5d c3 68 e0 7d b6 c0 68 ea b3 exception.instruction: int3 exception.exception_code: 0x80000003 exception.symbol: DllRegisterServer+0x72ec e5lojgiow+0x1105c exception.address: 0x7221105c registers.esp: 2552268 registers.edi: 13 registers.eax: 2000478246 registers.ebp: 33490944 registers.edx: 0 registers.ebx: 0 registers.esi: 64 registers.ecx: 0	1
__exception__ March 23, 2021, 6:07 p.m.	stacktrace: exception.instruction_r: cc c3 5d c3 33 c0 5d c3 68 e0 7d b6 c0 68 ea b3 exception.instruction: int3 exception.exception_code: 0x80000003 exception.symbol: DllRegisterServer+0x72ec e5lojgiow+0x1105c exception.address: 0x7221105c registers.esp: 2552268 registers.edi: 12 registers.eax: 2000478246 registers.ebp: 33490960 registers.edx: 0 registers.ebx: 0 registers.esi: 64 registers.ecx: 0	1
__exception__ March 23, 2021, 6:07 p.m.	stacktrace: exception.instruction_r: cc c3 5d c3 33 c0 5d c3 68 e0 7d b6 c0 68 ea b3 exception.instruction: int3 exception.exception_code: 0x80000003 exception.symbol: DllRegisterServer+0x72ec e5lojgiow+0x1105c exception.address: 0x7221105c registers.esp: 2552268 registers.edi: 11 registers.eax: 2000478246 registers.ebp: 33490976 registers.edx: 0 registers.ebx: 0 registers.esi: 64 registers.ecx: 0	1
__exception__ March 23, 2021, 6:07 p.m.	stacktrace: exception.instruction_r: cc c3 5d c3 33 c0 5d c3 68 e0 7d b6 c0 68 ea b3 exception.instruction: int3 exception.exception_code: 0x80000003 exception.symbol: DllRegisterServer+0x72ec e5lojgiow+0x1105c exception.address: 0x7221105c registers.esp: 2552268 registers.edi: 10 registers.eax: 2000478246 registers.ebp: 33490992 registers.edx: 0 registers.ebx: 0 registers.esi: 64 registers.ecx: 0	1
__exception__ March 23, 2021, 6:07 p.m.	stacktrace: exception.instruction_r: cc c3 5d c3 33 c0 5d c3 68 e0 7d b6 c0 68 ea b3 exception.instruction: int3 exception.exception_code: 0x80000003 exception.symbol: DllRegisterServer+0x72ec e5lojgiow+0x1105c exception.address: 0x7221105c registers.esp: 2552268 registers.edi: 9 registers.eax: 2000478246 registers.ebp: 33491008 registers.edx: 0 registers.ebx: 0 registers.esi: 64 registers.ecx: 0	1
__exception__ March 23, 2021, 6:07 p.m.	stacktrace: exception.instruction_r: cc c3 5d c3 33 c0 5d c3 68 e0 7d b6 c0 68 ea b3 exception.instruction: int3 exception.exception_code: 0x80000003 exception.symbol: DllRegisterServer+0x72ec e5lojgiow+0x1105c exception.address: 0x7221105c registers.esp: 2552268 registers.edi: 8 registers.eax: 2000478246 registers.ebp: 33491024 registers.edx: 0 registers.ebx: 0 registers.esi: 64 registers.ecx: 0	1
__exception__ March 23, 2021, 6:07 p.m.	stacktrace: exception.instruction_r: cc c3 5d c3 33 c0 5d c3 68 e0 7d b6 c0 68 ea b3 exception.instruction: int3 exception.exception_code: 0x80000003 exception.symbol: DllRegisterServer+0x72ec e5lojgiow+0x1105c exception.address: 0x7221105c registers.esp: 2552268 registers.edi: 7 registers.eax: 2000478246 registers.ebp: 33491040 registers.edx: 0 registers.ebx: 0 registers.esi: 64 registers.ecx: 0	1
__exception__ March 23, 2021, 6:07 p.m.	stacktrace: exception.instruction_r: cc c3 5d c3 33 c0 5d c3 68 e0 7d b6 c0 68 ea b3 exception.instruction: int3 exception.exception_code: 0x80000003 exception.symbol: DllRegisterServer+0x72ec e5lojgiow+0x1105c exception.address: 0x7221105c registers.esp: 2552268 registers.edi: 6 registers.eax: 2000478246 registers.ebp: 33491056 registers.edx: 0 registers.ebx: 0 registers.esi: 64 registers.ecx: 0	1
__exception__ March 23, 2021, 6:07 p.m.	stacktrace: exception.instruction_r: cc c3 5d c3 33 c0 5d c3 68 e0 7d b6 c0 68 ea b3 exception.instruction: int3 exception.exception_code: 0x80000003 exception.symbol: DllRegisterServer+0x72ec e5lojgiow+0x1105c exception.address: 0x7221105c registers.esp: 2552268 registers.edi: 5 registers.eax: 2000478246 registers.ebp: 33491072 registers.edx: 0 registers.ebx: 0 registers.esi: 64 registers.ecx: 0	1
__exception__ March 23, 2021, 6:07 p.m.	stacktrace: exception.instruction_r: cc c3 5d c3 33 c0 5d c3 68 e0 7d b6 c0 68 ea b3 exception.instruction: int3 exception.exception_code: 0x80000003 exception.symbol: DllRegisterServer+0x72ec e5lojgiow+0x1105c exception.address: 0x7221105c registers.esp: 2552268 registers.edi: 4 registers.eax: 2000478246 registers.ebp: 33491088 registers.edx: 0 registers.ebx: 0 registers.esi: 64 registers.ecx: 0	1
__exception__ March 23, 2021, 6:07 p.m.	stacktrace: exception.instruction_r: cc c3 5d c3 33 c0 5d c3 68 e0 7d b6 c0 68 ea b3 exception.instruction: int3 exception.exception_code: 0x80000003 exception.symbol: DllRegisterServer+0x72ec e5lojgiow+0x1105c exception.address: 0x7221105c registers.esp: 2552268 registers.edi: 3 registers.eax: 2000478246 registers.ebp: 33491104 registers.edx: 0 registers.ebx: 0 registers.esi: 64 registers.ecx: 0	1

Allocates read-write-execute memory (usually to unpack itself) (12 events)

Time & API	Arguments	Status
NtProtectVirtualMemory March 23, 2021, 6:06 p.m.	process_identifier: 7180 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x72255000 process_handle: 0xffffffff	1
NtProtectVirtualMemory March 23, 2021, 6:06 p.m.	process_identifier: 7180 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x738b1000 process_handle: 0xffffffff	1
NtProtectVirtualMemory March 23, 2021, 6:07 p.m.	process_identifier: 7180 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 16384 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x7225e000 process_handle: 0xffffffff	1
NtAllocateVirtualMemory March 23, 2021, 6:07 p.m.	process_identifier: 7180 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00380000 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0xffffffff	1
NtAllocateVirtualMemory March 23, 2021, 6:07 p.m.	process_identifier: 7180 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x003a0000 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0xffffffff	1
NtAllocateVirtualMemory March 23, 2021, 6:07 p.m.	process_identifier: 7180 region_size: 577536 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x008c0000 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0xffffffff	1
NtProtectVirtualMemory March 23, 2021, 6:06 p.m.	process_identifier: 4356 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x72255000 process_handle: 0xffffffff	1
NtProtectVirtualMemory March 23, 2021, 6:06 p.m.	process_identifier: 4356 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x738b1000 process_handle: 0xffffffff	1
NtProtectVirtualMemory March 23, 2021, 6:07 p.m.	process_identifier: 4356 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 16384 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x7225e000 process_handle: 0xffffffff	1
NtAllocateVirtualMemory March 23, 2021, 6:07 p.m.	process_identifier: 4356 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00380000 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0xffffffff	1
NtAllocateVirtualMemory March 23, 2021, 6:07 p.m.	process_identifier: 4356 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x003a0000 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0xffffffff	1
NtAllocateVirtualMemory March 23, 2021, 6:07 p.m.	process_identifier: 4356 region_size: 577536 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00440000 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0xffffffff	1

File has been identified by 9 AntiVirus engines on VirusTotal as malicious (9 events)

Elastic	malicious (high confidence)
FireEye	Generic.mg.8abd17bb45aaf7de
Sangfor	Trojan.Win32.Save.a
APEX	Malicious
BitDefender	Gen:Variant.Mikey.119841
SentinelOne	Static AI - Suspicious PE
McAfee	GenericRXAA-AA!8ABD17BB45AA
VBA32	BScope.Trojan.Wacatac
ESET-NOD32	a variant of Win32/GenKryptik.FDFN

Communicates with host for which no DNS query was performed (1 event)

host

172.217.25.14

e5lojgiow.tar

Process Tree Toggle all

Network Toggle all

Suricata Toggle all

Suricata Alerts

Suricata TLS

Signatures Toggle All