Report - ZeroBOX

ScreenShot

Info
Location map


Created	2021.03.17 09:29	Machine	s1_win7_x6401
Filename	mon128.dll
Type	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
AI Score	5	Behavior Score	7.8
ZERO API	file : malware
VT API (file)	43 detected (malicious, high confidence, Zusy, Emotet, Unsafe, Save, GenKryptik, confidence, 100%, WSSQ, Trickpak, Eawz, Trick, MALREP, THCAEBA, Krypt, FCTL, zdfur, ai score=85, TrickBot, Ymacco, score, R371611, 1239c4crYYR, GdSda, HgkASQoA)
md5	8b35f94c42d50c31bf4edb764ca77b69
sha256	d904c7490e84a5f5a01407d921f23dbe942f079ff1ffce6ca83e23d47251c5be
ssdeep	12288:B+QjOdLU2K5HmTbKbKKMFZys7tmwVoLQOwDvIu7UlVqV6WSUPLW:g/LUfU6MjvVeQFro+ZS
imphash	25a3bf96f64b55a69d3aaf04f6c99acc
impfuzzy	192:NxLVEwd9HcQkKkOTb+UChkUkbZBPccco5cLR8:7L/9pkwCsZ9ZzK8

Network IP location

Signature (19cnts)

Level	Description
danger	File has been identified by 43 AntiVirus engines on VirusTotal as malicious
watch	Communicates with host for which no DNS query was performed
notice	A process attempted to delay the analysis task.
notice	Allocates read-write-execute memory (usually to unpack itself)
notice	Changes read-write memory protection to read-execute (probably to avoid detection when setting all RWX flags at the same time)
notice	Checks adapter addresses which can be used to detect virtual network interfaces
notice	Checks for the Locally Unique Identifier on the system for a suspicious privilege
notice	Creates a suspicious process
notice	Creates hidden or system file
notice	One or more potentially interesting buffers were extracted
notice	Performs some HTTP requests
notice	Potentially malicious URLs were found in the process memory dump
notice	Terminates another process
notice	The binary likely contains encrypted or compressed data indicative of a packer
notice	Yara rule detected in process memory
info	Checks if process is being debugged by a debugger
info	Collects information to fingerprint the system (MachineGuid
info	Queries for the computername
info	The file contains an unknown PE resource name possibly indicative of a packer

Rules (58cnts)

Level	Name	Description	Collection
danger	Win32_Trojan_Emotet_1_Zero	Win32 Trojan Emotet	binaries (upload)
danger	Win32_Trojan_Gen_1_0904B0_Zero	Win32 Trojan Emotet	binaries (upload)
danger	Win_Trojan_Trickbot_Zero	Used Trickbot	binaries (upload)
notice	Str_Win32_Http_API	Match Windows Http API call	memory
notice	Str_Win32_Internet_API	Match Windows Inet API call	memory
info	anti_dbg	Checks if being debugged	memory
info	antisb_threatExpert	Anti-Sandbox checks for ThreatExpert	memory
info	Check_Dlls	(no description)	memory
info	DebuggerCheck__GlobalFlags	(no description)	memory
info	DebuggerCheck__QueryInfo	(no description)	memory
info	DebuggerCheck__RemoteAPI	(no description)	memory
info	DebuggerException__ConsoleCtrl	(no description)	memory
info	DebuggerException__SetConsoleCtrl	(no description)	memory
info	DebuggerHiding__Active	(no description)	memory
info	DebuggerHiding__Thread	(no description)	memory
info	disable_dep	Bypass DEP	memory
info	IsDLL	(no description)	binaries (upload)
info	IsPE32	(no description)	binaries (upload)
info	OS_Processor_Check_Zero	OS Processor Check Signature Zero	binaries (upload)
info	PE_Header_Zero	PE File Signature Zero	binaries (upload)
info	SEH__vectored	(no description)	memory
info	ThreadControl__Context	(no description)	memory
info	win_hook	Affect hook table	memory
info	create_com_service	Create a COM server	memory
info	create_service	Create a windows service	memory
info	cred_local	Steal credential	memory
info	escalate_priv	Escalade priviledges	memory
info	HasRichSignature	Rich Signature Check	binaries (upload)
info	inject_thread	Code injection with CreateRemoteThread in a remote process	memory
info	IsPacked	Entropy Check	binaries (upload)
info	IsWindowsGUI	(no description)	binaries (upload)
info	keylogger	Run a keylogger	binaries (upload)
info	keylogger	Run a keylogger	memory
info	migrate_apc	APC queue tasks migration	memory
info	network_dga	Communication using dga	memory
info	network_dns	Communications use DNS	memory
info	network_dropper	File downloader/dropper	memory
info	network_ftp	Communications over FTP	memory
info	network_http	Communications over HTTP	memory
info	network_p2p_win	Communications over P2P network	memory
info	network_tcp_listen	Listen for incoming communication	memory
info	network_tcp_socket	Communications over RAW socket	memory
info	network_udp_sock	Communications over UDP network	memory
info	screenshot	Take screenshot	binaries (upload)
info	screenshot	Take screenshot	memory
info	sniff_audio	Record Audio	memory
info	spreading_file	Malware can spread east-west file	memory
info	spreading_share	Malware can spread east-west using share drive	memory
info	Str_Win32_Wininet_Library	Match Windows Inet API library declaration	memory
info	Str_Win32_Winsock2_Library	Match Winsock 2 API library declaration	memory
info	win_files_operation	Affect private profile	binaries (upload)
info	win_files_operation	Affect private profile	memory
info	win_mutex	Create or check mutex	memory
info	win_private_profile	Affect private profile	binaries (upload)
info	win_private_profile	Affect private profile	memory
info	win_registry	Affect system registries	binaries (upload)
info	win_registry	Affect system registries	memory
info	win_token	Affect system token	memory

Network (7cnts) ?

Request	ASN Co	IP4	ZERO ?
https://ident.me/ whois	Linode, LLC	176.58.123.25	clean
150.134.208.175.b.barracudacentral.org whois		127.0.0.2	clean
150.134.208.175.cbl.abuseat.org whois			clean
ident.me whois	Linode, LLC	176.58.123.25	clean
150.134.208.175.zen.spamhaus.org whois			clean
176.58.123.25 whois	Linode, LLC	176.58.123.25	clean
103.225.138.94 whois	DCTV Cable Network Broadband Services Inc	103.225.138.94	mailcious

Report - mon128.dll

Signature (19cnts)

Rules (58cnts)

Network (7cnts) ?

Suricata ids

Similarity measure (PE file only) - Checking for service failure