popup
Summary | ZeroBOX
  1. Home
  2. Result
  3. Report
  4. Detail Analysis

360ServerNet.exe

  1. Resubmit sample
Category Machine Started Completed
FILE s1_win7_x6402 April 18, 2021, 1:30 p.m. April 18, 2021, 1:32 p.m.
Size 187.7KB
Type PE32+ executable (GUI) x86-64, for MS Windows
MD5 d6eeb868200cb461e5d0357555c56b76
SHA256 b0ba4d8778418f225625c124381273009cc812eb02d50490b20c5c4944861221
CRC32 6C16274A
ssdeep 3072:zzb9Pkq3c/XD9xcFaXR6ewALS3MlX7hSYjLZTyZr+ICG59r:zi1/XJxxR6eoASYpTyzd9r
PDB Path C:\VSwork\Bypass360\x64\Release\HTTPRrnShe.pdb
Yara
  • PE_Header_Zero - PE File Signature Zero
  • OS_Processor_Check_Zero - OS Processor Check Signature Zero
  • win_files_operation - Affect private profile
  • Str_Win32_Winsock2_Library - Match Winsock 2 API library declaration
  • IsPE64 - (no description)
  • IsWindowsGUI - (no description)
  • HasOverlay - Overlay Check
  • HasDigitalSignature - DigitalSignature Check
  • HasDebugData - DebugData Check
  • HasRichSignature - Rich Signature Check

Name Response Post-Analysis Lookup
No hosts contacted.
IP Address Status Action
172.217.25.14 Active Moloch

Suricata Alerts

No Suricata Alerts

Suricata TLS

No Suricata TLS

pdb_path C:\VSwork\Bypass360\x64\Release\HTTPRrnShe.pdb
Time & API Arguments Status Return Repeated

GlobalMemoryStatusEx

 1 1 0
section _RDATA
name RT_ICON language LANG_CHINESE filetype PNG image data, 256 x 256, 8-bit/color RGBA, non-interlaced sublanguage SUBLANG_CHINESE_SIMPLIFIED offset 0x000263d0 size 0x000086ce
name RT_ICON language LANG_CHINESE filetype PNG image data, 256 x 256, 8-bit/color RGBA, non-interlaced sublanguage SUBLANG_CHINESE_SIMPLIFIED offset 0x000263d0 size 0x000086ce
name RT_ICON language LANG_CHINESE filetype PNG image data, 256 x 256, 8-bit/color RGBA, non-interlaced sublanguage SUBLANG_CHINESE_SIMPLIFIED offset 0x000263d0 size 0x000086ce
name RT_ICON language LANG_CHINESE filetype PNG image data, 256 x 256, 8-bit/color RGBA, non-interlaced sublanguage SUBLANG_CHINESE_SIMPLIFIED offset 0x000263d0 size 0x000086ce
name RT_ICON language LANG_CHINESE filetype PNG image data, 256 x 256, 8-bit/color RGBA, non-interlaced sublanguage SUBLANG_CHINESE_SIMPLIFIED offset 0x000263d0 size 0x000086ce
name RT_GROUP_ICON language LANG_CHINESE filetype data sublanguage SUBLANG_CHINESE_SIMPLIFIED offset 0x0002eaa0 size 0x0000004c
name RT_VERSION language LANG_CHINESE filetype data sublanguage SUBLANG_CHINESE_SIMPLIFIED offset 0x0002eaf0 size 0x000002c4
Time & API Arguments Status Return Repeated

Process32NextW

 snapshot_handle: 0x0000000000000088
process_name: mobsync.exe
process_identifier: 1420
1 1 0

Process32NextW

 snapshot_handle: 0x0000000000000088
process_name: taskhost.exe
process_identifier: 8552
1 1 0

Process32NextW

 snapshot_handle: 0x0000000000000088
process_name: cmd.exe
process_identifier: 2240
1 1 0

Process32NextW

 snapshot_handle: 0x0000000000000088
process_name: conhost.exe
process_identifier: 6168
1 1 0

Process32NextW

 snapshot_handle: 0x0000000000000088
process_name: 360ServerNet.exe
process_identifier: 656
1 1 0

Process32NextW

 snapshot_handle: 0x0000000000000088
process_name: pw.exe
process_identifier: 6240
1 1 0
Cynet Malicious (score: 100)
eGambit PE.Heur.InvalidSig
CrowdStrike win/malicious_confidence_80% (W)
host 172.217.25.14
Time & API Arguments Status Return Repeated

NtCreateFile

 create_disposition: 1 (FILE_OPEN)
file_handle: 0x000000000000008c
filepath: \??\PhysicalDrive0
desired_access: 0x00100080 (FILE_READ_ATTRIBUTES|SYNCHRONIZE)
file_attributes: 0 ()
filepath_r: \??\PhysicalDrive0
create_options: 96 (FILE_NON_DIRECTORY_FILE|FILE_SYNCHRONOUS_IO_NONALERT)
status_info: 0 (FILE_SUPERSEDED)
share_access: 3 (FILE_SHARE_READ|FILE_SHARE_WRITE)
1 0 0

DeviceIoControl

 input_buffer:
control_code: 458752 (IOCTL_DISK_GET_DRIVE_GEOMETRY)
device_handle: 0x000000000000008c
output_buffer: Q ÿ?
1 1 0