popup
Summary | ZeroBOX
  1. Home
  2. Result
  3. Report
  4. Detail Analysis

regasm.exe

  1. Resubmit sample
Category Machine Started Completed
FILE s1_win7_x6402 April 13, 2021, 9:59 a.m. April 13, 2021, 10:14 a.m.
Size 201.5KB
Type PE32 executable (GUI) Intel 80386, for MS Windows, Nullsoft Installer self-extracting archive
MD5 dc8a2259a6b2075629f2f0d6a07cce78
SHA256 0b29230d55e89c425c2d9d707a09a6de31ccf4b093f51f6ba1027f0edd313584
CRC32 DF98E2B0
ssdeep 3072:HyewmN4skJ6rLPRC2xo+XOFWgIhK1bMcHLDkihoAf+sWyN0cubju3hHTKLG1kf:Hd1qit3hKucHvkihTNUbi3tKLz
Yara
  • escalate_priv - Escalade priviledges
  • screenshot - Take screenshot
  • win_registry - Affect system registries
  • win_token - Affect system token
  • win_private_profile - Affect private profile
  • win_files_operation - Affect private profile
  • PE_Header_Zero - PE File Signature Zero
  • IsPE32 - (no description)
  • IsWindowsGUI - (no description)
  • IsPacked - Entropy Check
  • HasOverlay - Overlay Check
  • HasRichSignature - Rich Signature Check

Suricata Alerts

No Suricata Alerts

Suricata TLS

No Suricata TLS

Time & API Arguments Status Return Repeated

IsDebuggerPresent

 0 0
Time & API Arguments Status Return Repeated

GlobalMemoryStatusEx

 1 1 0
section .ndata
suspicious_features GET method with no useragent header suspicious_request GET http://www.cashforhoustonhomes.com/svh9/?GzuD=WBjTZrPXs&_ZOx46=Z+2KIbireQ1N7FnKwLUmOBJgZshI3Ou6JZzTQOj9ZzGKN8aedgfhiB5hJ5s24i6+PaavtCZ9
suspicious_features GET method with no useragent header suspicious_request GET http://www.miucce.com/svh9/?_ZOx46=wImYdmeU9tMtg/ybNGHTf7iC39Zd9KaNnEwv//3GJN/5pEvSh61uDhX8FRs12IefCIEjTat4&GzuD=WBjTZrPXs
suspicious_features GET method with no useragent header suspicious_request GET http://www.daaprank.com/svh9/?GzuD=WBjTZrPXs&_ZOx46=pOyVBkpmjBl4UQ+st/zSPGZd3EmnGMA7ZuEPueNaeaG7OVKWgRfShdYn3SUkBQvyKRSGQXDu
suspicious_features GET method with no useragent header suspicious_request GET http://www.dookietime.com/svh9/?_ZOx46=E6nAtqyEn1iF0QlYxoLq2xWmaAW9lfylABBStkBhUOqiY1kqa+UcTjKQEuubYbEJPTnOF0eV&GzuD=WBjTZrPXs
suspicious_features GET method with no useragent header suspicious_request GET http://www.liuhanbao.com/svh9/?GzuD=WBjTZrPXs&_ZOx46=Wl3B3sBelUB4cX692W6XSN4h6pr274pQJPb9Dw6eyNKsSWZYCCPq26JR2eTyLHRPHDGEFeiL
suspicious_features GET method with no useragent header suspicious_request GET http://www.nearbygetaway.com/svh9/?_ZOx46=XkjUSRgusg5V481eiV1JDOqrMhhip3CDqkn8d3DGL0KYgs5OKfgRuUtNTmUiqmPQKS9U0CoI&GzuD=WBjTZrPXs
suspicious_features GET method with no useragent header suspicious_request GET http://www.aldlan-studio.com/svh9/?GzuD=WBjTZrPXs&_ZOx46=iUgadD8mG99znoInhcIeLrQXBXKqEwA1IwwA4YgT2BCb1zuBx9MX2SxVDgkG52FkHnGec8p3
suspicious_features GET method with no useragent header suspicious_request GET http://www.cultbehaviour.net/svh9/?GzuD=WBjTZrPXs&_ZOx46=j9Pk+tYvJJbsnCvnCx2gDll+Thl/DV2CEZ3yRX1xT3TJXASdxPEvuE+xFnWuRQ+KItuqSuNK
suspicious_features GET method with no useragent header suspicious_request GET http://www.orangepensiontrust.com/svh9/?_ZOx46=yVIJ+1ekb4x5Nt1sGTaSINqEVreOhkPwJg2QoK71/KoVrHRHPpEFie4loXw5vtKsgDWOW1Kt&GzuD=WBjTZrPXs
request POST http://www.cashforhoustonhomes.com/svh9/
request GET http://www.cashforhoustonhomes.com/svh9/?GzuD=WBjTZrPXs&_ZOx46=Z+2KIbireQ1N7FnKwLUmOBJgZshI3Ou6JZzTQOj9ZzGKN8aedgfhiB5hJ5s24i6+PaavtCZ9
request POST http://www.miucce.com/svh9/
request GET http://www.miucce.com/svh9/?_ZOx46=wImYdmeU9tMtg/ybNGHTf7iC39Zd9KaNnEwv//3GJN/5pEvSh61uDhX8FRs12IefCIEjTat4&GzuD=WBjTZrPXs
request POST http://www.daaprank.com/svh9/
request GET http://www.daaprank.com/svh9/?GzuD=WBjTZrPXs&_ZOx46=pOyVBkpmjBl4UQ+st/zSPGZd3EmnGMA7ZuEPueNaeaG7OVKWgRfShdYn3SUkBQvyKRSGQXDu
request POST http://www.dookietime.com/svh9/
request GET http://www.dookietime.com/svh9/?_ZOx46=E6nAtqyEn1iF0QlYxoLq2xWmaAW9lfylABBStkBhUOqiY1kqa+UcTjKQEuubYbEJPTnOF0eV&GzuD=WBjTZrPXs
request POST http://www.liuhanbao.com/svh9/
request GET http://www.liuhanbao.com/svh9/?GzuD=WBjTZrPXs&_ZOx46=Wl3B3sBelUB4cX692W6XSN4h6pr274pQJPb9Dw6eyNKsSWZYCCPq26JR2eTyLHRPHDGEFeiL
request POST http://www.nearbygetaway.com/svh9/
request GET http://www.nearbygetaway.com/svh9/?_ZOx46=XkjUSRgusg5V481eiV1JDOqrMhhip3CDqkn8d3DGL0KYgs5OKfgRuUtNTmUiqmPQKS9U0CoI&GzuD=WBjTZrPXs
request POST http://www.aldlan-studio.com/svh9/
request GET http://www.aldlan-studio.com/svh9/?GzuD=WBjTZrPXs&_ZOx46=iUgadD8mG99znoInhcIeLrQXBXKqEwA1IwwA4YgT2BCb1zuBx9MX2SxVDgkG52FkHnGec8p3
request POST http://www.cultbehaviour.net/svh9/
request GET http://www.cultbehaviour.net/svh9/?GzuD=WBjTZrPXs&_ZOx46=j9Pk+tYvJJbsnCvnCx2gDll+Thl/DV2CEZ3yRX1xT3TJXASdxPEvuE+xFnWuRQ+KItuqSuNK
request POST http://www.orangepensiontrust.com/svh9/
request GET http://www.orangepensiontrust.com/svh9/?_ZOx46=yVIJ+1ekb4x5Nt1sGTaSINqEVreOhkPwJg2QoK71/KoVrHRHPpEFie4loXw5vtKsgDWOW1Kt&GzuD=WBjTZrPXs
request POST http://www.cashforhoustonhomes.com/svh9/
request POST http://www.miucce.com/svh9/
request POST http://www.daaprank.com/svh9/
request POST http://www.dookietime.com/svh9/
request POST http://www.liuhanbao.com/svh9/
request POST http://www.nearbygetaway.com/svh9/
request POST http://www.aldlan-studio.com/svh9/
request POST http://www.cultbehaviour.net/svh9/
request POST http://www.orangepensiontrust.com/svh9/
Time & API Arguments Status Return Repeated

NtProtectVirtualMemory

 process_identifier: 9076
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x73772000
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 9076
region_size: 262144
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x023d0000
allocation_type: 8192 (MEM_RESERVE)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 9076
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x023d0000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 9076
region_size: 8192
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x023d1000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 3388
region_size: 3158016
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x00970000
allocation_type: 12288 (MEM_COMMIT|MEM_RESERVE)
process_handle: 0xffffffff
1 0 0
file C:\Users\test22\AppData\Local\Temp\nsd8590.tmp\lp2q5fglra.dll
file C:\Users\test22\AppData\Local\Temp\nsd8590.tmp\lp2q5fglra.dll
FireEye Generic.mg.dc8a2259a6b20756
Kaspersky HEUR:Trojan.Win32.Zenpak.gen
VIPRE Trojan.Win32.Generic!BT
Sophos Generic ML PUA (PUA)
APEX Malicious
Microsoft Trojan:Win32/Wacatac.B!ml
AhnLab-V3 Trojan/Win.Generic.R415229
Qihoo-360 HEUR/QVM42.0.8C2F.Malware.Gen
Time & API Arguments Status Return Repeated

LookupPrivilegeValueW

 system_name:
privilege_name: SeDebugPrivilege
1 1 0
host 172.217.25.14
Process injection Process 9076 called NtSetContextThread to modify thread in remote process 3388
Time & API Arguments Status Return Repeated

NtSetContextThread

 registers.eip: 2000355780
registers.esp: 1638384
registers.edi: 0
registers.eax: 4313152
registers.ebp: 0
registers.edx: 0
registers.ebx: 2130567168
registers.esi: 0
registers.ecx: 0
thread_handle: 0x00000210
process_identifier: 3388
1 0 0
dead_host 198.54.117.198:80
dead_host 198.54.117.197:80