Summary | ZeroBOX

Category	Machine	Started	Completed
FILE	s1_win7_x6402	March 31, 2021, 6:11 p.m.	March 31, 2021, 6:27 p.m.

Size	74.2KB
Type	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
MD5	`3a5ab9cbc12960f6815d36cc3689fbcd`
SHA256	`ef2b0fcedd1f0152f46bd70df17283496544281d5ecff14b0ba81dfa2c091ac6`
CRC32	`C4D82356`
ssdeep	`384:QM+fTxCRc8fT+8vKKbdNB/4acA4hIbrw9bJ30YGxfoMNbhW2sj94IVbJhKUpnegp:DaxqfT+6VK3A4m2bHcWooj96he`
Yara	PE_Header_Zero - PE File Signature Zero IsPE32 - (no description) IsNET_EXE - (no description) IsWindowsGUI - (no description) HasOverlay - Overlay Check Win_Backdoor_AsyncRAT_Zero - Win Backdoor AsyncRAT

mazx.exe "C:\Users\test22\AppData\Local\Temp\mazx.exe"
5032

Name	Response	Post-Analysis Lookup
dqdqededqedqe.tk	A 104.21.87.185 A 172.67.145.154	104.21.87.185

IP Address	Status	Action
104.21.87.185	Active	Moloch
164.124.101.2	Active	Moloch
172.217.25.14	Active	Moloch

Suricata Alerts

No Suricata Alerts

Suricata TLS

No Suricata TLS

Queries for the computername (2 events)

Time & API	Arguments	Status	Return	Repeated
GetComputerNameA March 31, 2021, 6:11 p.m.	computer_name: TEST22-PC	1	1	0
GetComputerNameW March 31, 2021, 6:11 p.m.	computer_name: TEST22-PC	1	1	0

Checks if process is being debugged by a debugger (4 events)

Time & API	Arguments	Status	Return	Repeated
IsDebuggerPresent March 31, 2021, 6:11 p.m.			0	0
IsDebuggerPresent March 31, 2021, 6:11 p.m.			0	0
IsDebuggerPresent March 31, 2021, 6:11 p.m.			0	0
IsDebuggerPresent March 31, 2021, 6:11 p.m.			0	0

Checks amount of memory in system, this can be used to detect virtual machines that have a low amount of memory available (1 event)

Time & API	Arguments	Status	Return	Repeated
GlobalMemoryStatusEx March 31, 2021, 6:11 p.m.		1	1	0

HTTP traffic contains suspicious features which may be indicative of malware related traffic (3 events)

suspicious_features	GET method with no useragent header	suspicious_request	GET http://dqdqededqedqe.tk/liverpool-fc-news/features/steven-gerrard-liverpool-future-dalglish--goal-057C8117104467C249433B5BBD78F545.html
suspicious_features	GET method with no useragent header	suspicious_request	GET http://dqdqededqedqe.tk/liverpool-fc-news/features/steven-gerrard-liverpool-future-dalglish--goal-AFC13E0899DE73674432EDC0266C5BF0.html
suspicious_features	GET method with no useragent header	suspicious_request	GET http://dqdqededqedqe.tk/liverpool-fc-news/features/steven-gerrard-liverpool-future-dalglish--goal-3E3BE66624AA8F8BB2ECFBCCDF1AEE5B.html

Performs some HTTP requests (3 events)

request	GET http://dqdqededqedqe.tk/liverpool-fc-news/features/steven-gerrard-liverpool-future-dalglish--goal-057C8117104467C249433B5BBD78F545.html
request	GET http://dqdqededqedqe.tk/liverpool-fc-news/features/steven-gerrard-liverpool-future-dalglish--goal-AFC13E0899DE73674432EDC0266C5BF0.html
request	GET http://dqdqededqedqe.tk/liverpool-fc-news/features/steven-gerrard-liverpool-future-dalglish--goal-3E3BE66624AA8F8BB2ECFBCCDF1AEE5B.html

Allocates read-write-execute memory (usually to unpack itself) (20 events)

Time & API	Arguments	Status
NtAllocateVirtualMemory March 31, 2021, 6:11 p.m.	process_identifier: 5032 region_size: 2162688 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00670000 allocation_type: 8192 (MEM_RESERVE) process_handle: 0xffffffff	1
NtAllocateVirtualMemory March 31, 2021, 6:11 p.m.	process_identifier: 5032 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00840000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtProtectVirtualMemory March 31, 2021, 6:11 p.m.	process_identifier: 5032 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x6fba1000 process_handle: 0xffffffff	1
NtProtectVirtualMemory March 31, 2021, 6:11 p.m.	process_identifier: 5032 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x6fba2000 process_handle: 0xffffffff	1
NtAllocateVirtualMemory March 31, 2021, 6:11 p.m.	process_identifier: 5032 region_size: 786432 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00ac0000 allocation_type: 8192 (MEM_RESERVE) process_handle: 0xffffffff	1
NtAllocateVirtualMemory March 31, 2021, 6:11 p.m.	process_identifier: 5032 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00b40000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory March 31, 2021, 6:11 p.m.	process_identifier: 5032 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00422000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory March 31, 2021, 6:11 p.m.	process_identifier: 5032 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0043c000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory March 31, 2021, 6:11 p.m.	process_identifier: 5032 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0042c000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory March 31, 2021, 6:11 p.m.	process_identifier: 5032 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00810000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory March 31, 2021, 6:11 p.m.	process_identifier: 5032 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00455000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory March 31, 2021, 6:11 p.m.	process_identifier: 5032 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0045b000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory March 31, 2021, 6:11 p.m.	process_identifier: 5032 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00457000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory March 31, 2021, 6:11 p.m.	process_identifier: 5032 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0042a000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory March 31, 2021, 6:11 p.m.	process_identifier: 5032 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0044a000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory March 31, 2021, 6:11 p.m.	process_identifier: 5032 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00447000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory March 31, 2021, 6:11 p.m.	process_identifier: 5032 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0043a000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory March 31, 2021, 6:11 p.m.	process_identifier: 5032 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00446000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory March 31, 2021, 6:11 p.m.	process_identifier: 5032 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0044b000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory March 31, 2021, 6:11 p.m.	process_identifier: 5032 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00811000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1

Checks adapter addresses which can be used to detect virtual network interfaces (1 event)

Time & API	Arguments	Status	Return	Repeated
GetAdaptersAddresses March 31, 2021, 6:11 p.m.	flags: 15 family: 0		111	0

Communicates with host for which no DNS query was performed (1 event)

host

172.217.25.14

File has been identified by 11 AntiVirus engines on VirusTotal as malicious (11 events)

Elastic	malicious (high confidence)
McAfee	GenericRXOD-FX!3A5AB9CBC129
Cylance	Unsafe
Sangfor	Trojan.Win32.Save.a
ESET-NOD32	a variant of MSIL/TrojanDownloader.Agent.HRA
APEX	Malicious
Kaspersky	UDS:DangerousObject.Multi.Generic
FireEye	Generic.mg.3a5ab9cbc12960f6
Microsoft	Program:Win32/Wacapew.C!ml
Cynet	Malicious (score: 100)
BitDefenderTheta	Gen:NN.ZemsilF.34662.em1@auHgU3fi

mazx.exe

Process Tree Toggle all

Network Toggle all

Suricata Toggle all

Suricata Alerts

Suricata TLS

Signatures Toggle All