Summary | ZeroBOX

Category	Machine	Started	Completed
FILE	s1_win7_x6402	April 9, 2021, 11:32 a.m.	April 9, 2021, 11:50 a.m.

Size	32.0KB
Type	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
MD5	`cc94cc480b95de1f207a02f857051298`
SHA256	`d5ecf828a41fdd731fde4c7ecc9046a0dbaeb0d8cfaf45338a5f2f904ee274a5`
CRC32	`BC16A02F`
ssdeep	`768:0685M68XZVoChjE0fVZwTV8d2VzaYqKnWG/oTZjR97dOaP+A3ksgkWrkUYcLdaF:0L8X7oChjE0dZwh8dEzaRtX+A/Wo4QF`
PDB Path	Z:\Users\wizzlabs\Desktop\Working Products\Special Random\NewRanMultThreee\NewRanMultTwo\obj\Release\Trangilar.pdb
Yara	Win_Backdoor_AsyncRAT_Zero - Win Backdoor AsyncRAT PE_Header_Zero - PE File Signature Zero IsPE32 - (no description) IsNET_EXE - (no description) IsWindowsGUI - (no description) HasDebugData - DebugData Check

Three.exe "C:\Users\test22\AppData\Local\Temp\Three.exe"
7140

Name	Response	Post-Analysis Lookup
No hosts contacted.

IP Address	Status	Action
172.217.25.14	Active	Moloch

Suricata Alerts

No Suricata Alerts

Suricata TLS

No Suricata TLS

Checks if process is being debugged by a debugger (1 event)

Time & API	Arguments	Status	Return	Repeated
IsDebuggerPresent April 9, 2021, 11:25 a.m.			0	0

Collects information to fingerprint the system (MachineGuid, DigitalProductId, SystemBiosDate) (1 event)

registry

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\MachineGuid

This executable has a PDB path (1 event)

pdb_path

Z:\Users\wizzlabs\Desktop\Working Products\Special Random\NewRanMultThreee\NewRanMultTwo\obj\Release\Trangilar.pdb

Checks amount of memory in system, this can be used to detect virtual machines that have a low amount of memory available (1 event)

Time & API	Arguments	Status	Return	Repeated
GlobalMemoryStatusEx April 9, 2021, 11:25 a.m.		1	1	0

Allocates read-write-execute memory (usually to unpack itself) (43 events)

Time & API	Arguments	Status
NtAllocateVirtualMemory April 9, 2021, 11:25 a.m.	process_identifier: 7140 region_size: 1441792 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0000000000820000 allocation_type: 8192 (MEM_RESERVE) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory April 9, 2021, 11:25 a.m.	process_identifier: 7140 region_size: 8192 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0000000000900000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory April 9, 2021, 11:25 a.m.	process_identifier: 7140 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fef2361000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory April 9, 2021, 11:25 a.m.	process_identifier: 7140 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fef25de000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory April 9, 2021, 11:25 a.m.	process_identifier: 7140 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fef25de000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory April 9, 2021, 11:25 a.m.	process_identifier: 7140 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fef25df000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory April 9, 2021, 11:25 a.m.	process_identifier: 7140 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fef25df000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory April 9, 2021, 11:25 a.m.	process_identifier: 7140 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fef25df000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory April 9, 2021, 11:25 a.m.	process_identifier: 7140 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fef25df000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory April 9, 2021, 11:25 a.m.	process_identifier: 7140 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fef25df000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory April 9, 2021, 11:25 a.m.	process_identifier: 7140 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fef25df000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory April 9, 2021, 11:25 a.m.	process_identifier: 7140 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fef25df000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory April 9, 2021, 11:25 a.m.	process_identifier: 7140 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fef25df000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory April 9, 2021, 11:25 a.m.	process_identifier: 7140 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fef25e0000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory April 9, 2021, 11:25 a.m.	process_identifier: 7140 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fef25e0000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory April 9, 2021, 11:25 a.m.	process_identifier: 7140 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fef25e0000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory April 9, 2021, 11:25 a.m.	process_identifier: 7140 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fef25e0000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory April 9, 2021, 11:25 a.m.	process_identifier: 7140 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fef25e0000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory April 9, 2021, 11:25 a.m.	process_identifier: 7140 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fef25e1000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory April 9, 2021, 11:25 a.m.	process_identifier: 7140 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fef25e1000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory April 9, 2021, 11:25 a.m.	process_identifier: 7140 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fef25e1000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory April 9, 2021, 11:25 a.m.	process_identifier: 7140 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fef25e1000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory April 9, 2021, 11:25 a.m.	process_identifier: 7140 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fef25de000 process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory April 9, 2021, 11:25 a.m.	process_identifier: 7140 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007ff00032000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory April 9, 2021, 11:25 a.m.	process_identifier: 7140 region_size: 589824 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fffff20000 allocation_type: 1056768 (MEM_RESERVE\|MEM_TOP_DOWN) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory April 9, 2021, 11:25 a.m.	process_identifier: 7140 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fffff20000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory April 9, 2021, 11:25 a.m.	process_identifier: 7140 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fffff20000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory April 9, 2021, 11:25 a.m.	process_identifier: 7140 region_size: 65536 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fffff10000 allocation_type: 1056768 (MEM_RESERVE\|MEM_TOP_DOWN) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory April 9, 2021, 11:25 a.m.	process_identifier: 7140 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fffff10000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory April 9, 2021, 11:25 a.m.	process_identifier: 7140 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007ff000ea000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory April 9, 2021, 11:25 a.m.	process_identifier: 7140 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007ff00022000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory April 9, 2021, 11:25 a.m.	process_identifier: 7140 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007ff00033000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory April 9, 2021, 11:25 a.m.	process_identifier: 7140 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007ff000fa000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory April 9, 2021, 11:25 a.m.	process_identifier: 7140 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007ff00122000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory April 9, 2021, 11:25 a.m.	process_identifier: 7140 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007ff000fd000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory April 9, 2021, 11:25 a.m.	process_identifier: 7140 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007ff0003c000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory April 9, 2021, 11:25 a.m.	process_identifier: 7140 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007ff00034000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory April 9, 2021, 11:25 a.m.	process_identifier: 7140 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007ff00170000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory April 9, 2021, 11:25 a.m.	process_identifier: 7140 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007ff000e2000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory April 9, 2021, 11:25 a.m.	process_identifier: 7140 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007ff000eb000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory April 9, 2021, 11:25 a.m.	process_identifier: 7140 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007ff00035000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory April 9, 2021, 11:25 a.m.	process_identifier: 7140 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007ff0003a000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory April 9, 2021, 11:25 a.m.	process_identifier: 7140 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007ff0004f000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1

Communicates with host for which no DNS query was performed (1 event)

host

172.217.25.14

File has been identified by 32 AntiVirus engines on VirusTotal as malicious (32 events)

MicroWorld-eScan	Trojan.GenericKD.36660550
FireEye	Trojan.GenericKD.36660550
Cylance	Unsafe
Sangfor	Trojan.MSIL.Bsymem.gen
K7AntiVirus	Adware ( 00506b141 )
Alibaba	AdWare:MSIL/CsdiMonetize.eb3e8852
K7GW	Adware ( 00506b141 )
BitDefenderTheta	Gen:NN.ZemsilCO.34670.cm0@amJOhYo
Symantec	ML.Attribute.HighConfidence
ESET-NOD32	a variant of MSIL/Adware.CsdiMonetize.F
Avast	Win32:AdwareX-gen [Adw]
Kaspersky	HEUR:Trojan.MSIL.Bsymem.gen
BitDefender	Trojan.GenericKD.36660550
NANO-Antivirus	Trojan.Win32.GenericKD.eoucic
Paloalto	generic.ml
Ad-Aware	Trojan.GenericKD.36660550
APEX	Malicious
MAX	malware (ai score=83)
Kingsoft	Win32.Troj.Undef.(kcloud)
AegisLab	Trojan.MSIL.Bsymem.4!c
GData	Win32.Application.Agent.UZ74UL
AhnLab-V3	PUP/Win.Generic.C4407073
McAfee	Artemis!CC94CC480B95
Malwarebytes	Malware.AI.3846164771
Ikarus	AdWare.MSIL.Csdimonetize
Rising	Trojan.Bsymem!8.FAE7 (CLOUD)
SentinelOne	Static AI - Malicious PE
Fortinet	Riskware/Bsymem
AVG	Win32:AdwareX-gen [Adw]
Panda	Trj/GdSda.A
CrowdStrike	win/malicious_confidence_80% (W)
Qihoo-360	Win32/Trojan.Bsymem.HgIASSUA

Three.exe

Process Tree Toggle all

Network Toggle all

Suricata Toggle all

Suricata Alerts

Suricata TLS

Signatures Toggle All