Summary | ZeroBOX

Category	Machine	Started	Completed
FILE	s1_win7_x6402	April 3, 2021, 10:37 a.m.	April 3, 2021, 10:39 a.m.

Size	681.9KB
Type	PE32 executable (GUI) Intel 80386, for MS Windows
MD5	`3484b25f2ba1dbb96d27992e52a1f042`
SHA256	`97488be036cb1cf1a500188d3449062f4f10d83afb57630a8f6497edb196dc21`
CRC32	`3E1FF012`
ssdeep	`12288:VoJqNIPtNmO6IOOEp0TMlja7NRl2PSVikIyoyueh+AkHcnLwuukoCOD6zlmjOz+2:VoJEKZ6IEGTMxapRl2PSwHTehy6B1+p4`
Yara	network_http - Communications over HTTP screenshot - Take screenshot win_files_operation - Affect private profile Str_Win32_Wininet_Library - Match Windows Inet API library declaration Str_Win32_Internet_API - Match Windows Inet API call Str_Win32_Http_API - Match Windows Http API call PE_Header_Zero - PE File Signature Zero OS_Processor_Check_Zero - OS Processor Check Signature Zero IsPE32 - (no description) IsWindowsGUI - (no description) HasOverlay - Overlay Check HasDebugData - DebugData Check HasRichSignature - Rich Signature Check

build.exe "C:\Users\test22\AppData\Local\Temp\build.exe"
7132

Name	Response	Post-Analysis Lookup
basilev12.beget.tech

IP Address	Status	Action
164.124.101.2	Active	Moloch
172.217.25.14	Active	Moloch

Suricata Alerts

No Suricata Alerts

Suricata TLS

No Suricata TLS

Tries to locate where the browsers are installed (1 event)

registry

HKEY_LOCAL_MACHINE\SOFTWARE\Mozilla\Mozilla Firefox

Allocates read-write-execute memory (usually to unpack itself) (1 event)

Time & API	Arguments	Status	Return	Repeated
NtProtectVirtualMemory April 3, 2021, 10:37 a.m.	process_identifier: 7132 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x73772000 process_handle: 0xffffffff	1	0	0

Steals private information from local Internet browsers (2 events)

file	C:\Users\test22\AppData\Local\Google\Chrome\User Data\Local State
registry	HKEY_LOCAL_MACHINE\SOFTWARE\Mozilla\Mozilla Firefox

Searches running processes potentially to identify processes for sandbox evasion, code injection or memory dumping (42 events)

Time & API	Arguments	Status	Return
Process32NextW April 3, 2021, 10:37 a.m.	snapshot_handle: 0x000000cc process_name: [System Process] process_identifier: 0	1	1
Process32NextW April 3, 2021, 10:37 a.m.	snapshot_handle: 0x000000cc process_name: System process_identifier: 4	1	1
Process32NextW April 3, 2021, 10:37 a.m.	snapshot_handle: 0x000000cc process_name: smss.exe process_identifier: 224	1	1
Process32NextW April 3, 2021, 10:37 a.m.	snapshot_handle: 0x000000cc process_name: csrss.exe process_identifier: 300	1	1
Process32NextW April 3, 2021, 10:37 a.m.	snapshot_handle: 0x000000cc process_name: wininit.exe process_identifier: 348	1	1
Process32NextW April 3, 2021, 10:37 a.m.	snapshot_handle: 0x000000cc process_name: csrss.exe process_identifier: 364	1	1
Process32NextW April 3, 2021, 10:37 a.m.	snapshot_handle: 0x000000cc process_name: winlogon.exe process_identifier: 396	1	1
Process32NextW April 3, 2021, 10:37 a.m.	snapshot_handle: 0x000000cc process_name: services.exe process_identifier: 440	1	1
Process32NextW April 3, 2021, 10:37 a.m.	snapshot_handle: 0x000000cc process_name: lsass.exe process_identifier: 456	1	1
Process32NextW April 3, 2021, 10:37 a.m.	snapshot_handle: 0x000000cc process_name: lsm.exe process_identifier: 464	1	1
Process32NextW April 3, 2021, 10:37 a.m.	snapshot_handle: 0x000000cc process_name: svchost.exe process_identifier: 568	1	1
Process32NextW April 3, 2021, 10:37 a.m.	snapshot_handle: 0x000000cc process_name: svchost.exe process_identifier: 640	1	1
Process32NextW April 3, 2021, 10:37 a.m.	snapshot_handle: 0x000000cc process_name: svchost.exe process_identifier: 700	1	1
Process32NextW April 3, 2021, 10:37 a.m.	snapshot_handle: 0x000000cc process_name: svchost.exe process_identifier: 776	1	1
Process32NextW April 3, 2021, 10:37 a.m.	snapshot_handle: 0x000000cc process_name: svchost.exe process_identifier: 824	1	1
Process32NextW April 3, 2021, 10:37 a.m.	snapshot_handle: 0x000000cc process_name: svchost.exe process_identifier: 968	1	1
Process32NextW April 3, 2021, 10:37 a.m.	snapshot_handle: 0x000000cc process_name: svchost.exe process_identifier: 264	1	1
Process32NextW April 3, 2021, 10:37 a.m.	snapshot_handle: 0x000000cc process_name: spoolsv.exe process_identifier: 820	1	1
Process32NextW April 3, 2021, 10:37 a.m.	snapshot_handle: 0x000000cc process_name: svchost.exe process_identifier: 292	1	1
Process32NextW April 3, 2021, 10:37 a.m.	snapshot_handle: 0x000000cc process_name: svchost.exe process_identifier: 1192	1	1
Process32NextW April 3, 2021, 10:37 a.m.	snapshot_handle: 0x000000cc process_name: srvany.exe process_identifier: 1244	1	1
Process32NextW April 3, 2021, 10:37 a.m.	snapshot_handle: 0x000000cc process_name: taskhost.exe process_identifier: 1284	1	1
Process32NextW April 3, 2021, 10:37 a.m.	snapshot_handle: 0x000000cc process_name: KMService.exe process_identifier: 1324	1	1
Process32NextW April 3, 2021, 10:37 a.m.	snapshot_handle: 0x000000cc process_name: conhost.exe process_identifier: 1376	1	1
Process32NextW April 3, 2021, 10:37 a.m.	snapshot_handle: 0x000000cc process_name: sppsvc.exe process_identifier: 1800	1	1
Process32NextW April 3, 2021, 10:37 a.m.	snapshot_handle: 0x000000cc process_name: svchost.exe process_identifier: 1876	1	1
Process32NextW April 3, 2021, 10:37 a.m.	snapshot_handle: 0x000000cc process_name: dwm.exe process_identifier: 1496	1	1
Process32NextW April 3, 2021, 10:37 a.m.	snapshot_handle: 0x000000cc process_name: explorer.exe process_identifier: 1848	1	1
Process32NextW April 3, 2021, 10:37 a.m.	snapshot_handle: 0x000000cc process_name: SearchIndexer.exe process_identifier: 2548	1	1
Process32NextW April 3, 2021, 10:37 a.m.	snapshot_handle: 0x000000cc process_name: thunderbird.exe process_identifier: 3960	1	1
Process32NextW April 3, 2021, 10:37 a.m.	snapshot_handle: 0x000000cc process_name: pw.exe process_identifier: 5008	1	1
Process32NextW April 3, 2021, 10:37 a.m.	snapshot_handle: 0x000000cc process_name: audiodg.exe process_identifier: 7936	1	1
Process32NextW April 3, 2021, 10:37 a.m.	snapshot_handle: 0x000000cc process_name: splwow64.exe process_identifier: 3928	1	1
Process32NextW April 3, 2021, 10:37 a.m.	snapshot_handle: 0x000000cc process_name: SearchProtocolHost.exe process_identifier: 3816	1	1
Process32NextW April 3, 2021, 10:37 a.m.	snapshot_handle: 0x000000cc process_name: SearchFilterHost.exe process_identifier: 7776	1	1
Process32NextW April 3, 2021, 10:37 a.m.	snapshot_handle: 0x000000cc process_name: mobsync.exe process_identifier: 1420	1	1
Process32NextW April 3, 2021, 10:37 a.m.	snapshot_handle: 0x000000cc process_name: pw.exe process_identifier: 6252	1	1
Process32NextW April 3, 2021, 10:37 a.m.	snapshot_handle: 0x000000cc process_name: taskhost.exe process_identifier: 2100	1	1
Process32NextW April 3, 2021, 10:37 a.m.	snapshot_handle: 0x000000cc process_name: cmd.exe process_identifier: 8356	1	1
Process32NextW April 3, 2021, 10:37 a.m.	snapshot_handle: 0x000000cc process_name: conhost.exe process_identifier: 4336	1	1
Process32NextW April 3, 2021, 10:37 a.m.	snapshot_handle: 0x000000cc process_name: build.exe process_identifier: 7132	1	1
Process32NextW April 3, 2021, 10:37 a.m.	snapshot_handle: 0x000000cc process_name: pw.exe process_identifier: 5620	1	1

Communicates with host for which no DNS query was performed (1 event)

host

172.217.25.14

Attempts to access Bitcoin/ALTCoin wallets (2 events)

file	C:\wallet.dat
file	C:\Users\test22\AppData\Roaming\Electrum\wallets

Disables proxy possibly for traffic interception (1 event)

Time & API	Arguments	Status	Return	Repeated
RegSetValueExA April 3, 2021, 10:37 a.m.	key_handle: 0x00000258 regkey_r: ProxyEnable reg_type: 4 (REG_DWORD) value: 0 regkey: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ProxyEnable	1	0	0

Harvests credentials from local FTP client softwares (10 events)

file	C:\Users\Default\AppData\Roaming\FileZilla\sitemanager.xml
file	C:\Users\Default User\AppData\Roaming\FileZilla\recentservers.xml
file	C:\Users\test22\AppData\Roaming\FileZilla\recentservers.xml
file	C:\Users\Default\AppData\Roaming\FileZilla\recentservers.xml
file	C:\Users\Public\AppData\Roaming\FileZilla\sitemanager.xml
file	C:\Users\Public\AppData\Roaming\FileZilla\recentservers.xml
file	C:\Users\Default User\AppData\Roaming\FileZilla\sitemanager.xml
file	C:\Users\test22\AppData\Roaming\FileZilla\sitemanager.xml
file	C:\Users\All Users\AppData\Roaming\FileZilla\sitemanager.xml
file	C:\Users\All Users\AppData\Roaming\FileZilla\recentservers.xml

Harvests information related to installed instant messenger clients (5 events)

file	C:\Users\All Users\AppData\Roaming\.purple\accounts.xml
file	C:\Users\Default User\AppData\Roaming\.purple\accounts.xml
file	C:\Users\test22\AppData\Roaming\.purple\accounts.xml
file	C:\Users\Default\AppData\Roaming\.purple\accounts.xml
file	C:\Users\Public\AppData\Roaming\.purple\accounts.xml

File has been identified by 49 AntiVirus engines on VirusTotal as malicious (49 events)

Elastic	malicious (high confidence)
MicroWorld-eScan	Gen:Variant.Stealer.7
FireEye	Generic.mg.3484b25f2ba1dbb9
McAfee	GenericRXMZ-DZ!3484B25F2BA1
Cylance	Unsafe
Zillya	Trojan.Bobik.Win32.2070
Sangfor	Trojan.Win32.StellarStealer.SBR
K7AntiVirus	Spyware ( 005687121 )
Alibaba	TrojanSpy:Win32/StellarStealer.119494b0
K7GW	Spyware ( 005687121 )
CrowdStrike	win/malicious_confidence_80% (W)
Cyren	W32/Trojan2.QDAM
Symantec	ML.Attribute.HighConfidence
ESET-NOD32	a variant of Win32/Spy.Agent.PYU
APEX	Malicious
Avast	Win32:PWSX-gen [Trj]
ClamAV	Win.Malware.Zusy-9812688-0
Kaspersky	HEUR:Trojan-Spy.Win32.Bobik.gen
BitDefender	Gen:Variant.Stealer.7
NANO-Antivirus	Trojan.Win32.Bobik.innsnn
Rising	Spyware.Agent!8.C6 (C64:YzY0OtP2hpfCUG2A)
Ad-Aware	Gen:Variant.Stealer.7
Sophos	Mal/Generic-S
DrWeb	Trojan.PWS.Steam.18689
VIPRE	Trojan.Win32.Generic!BT
McAfee-GW-Edition	GenericRXMZ-DZ!3484B25F2BA1
Emsisoft	Gen:Variant.Stealer.7 (B)
Paloalto	generic.ml
Jiangmin	TrojanSpy.Bobik.mi
Avira	HEUR/AGEN.1141176
MAX	malware (ai score=86)
Microsoft	Trojan:Win32/StellarStealer.SBR!MSR
Gridinsoft	Spy.Win32.Keylogger.oa!s1
ViRobot	Trojan.Win32.S.Agent.698280
ZoneAlarm	HEUR:Trojan-Spy.Win32.Bobik.gen
GData	Win32.Trojan.PSE.3YNIAA
Cynet	Malicious (score: 100)
AhnLab-V3	Trojan/Win32.RL_Stealer.R355109
BitDefenderTheta	Gen:NN.ZexaF.34662.QqY@aW0S6vo
ALYac	Gen:Variant.Stealer.7
VBA32	TrojanSpy.Bobik
Malwarebytes	Generic.Trojan.Dropper.DDS
TrendMicro-HouseCall	TROJ_GEN.R002C0DD121
Tencent	Malware.Win32.Gencirc.10ce2a40
Fortinet	W32/GenKryptik.EZNX!tr
AVG	Win32:PWSX-gen [Trj]
Cybereason	malicious.f2ba1d
Panda	Trj/GdSda.A
Qihoo-360	Win32/TrojanSpy.Bobik.HgIASR4A

build.exe

Process Tree Toggle all

Network Toggle all

Suricata Toggle all

Suricata Alerts

Suricata TLS

Signatures Toggle All