Summary | ZeroBOX

Category	Machine	Started	Completed
FILE	s1_win7_x6402	April 23, 2021, 6:12 p.m.	April 23, 2021, 6:40 p.m.

Size	21.0KB
Type	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
MD5	`b0ea02e59dcda980a26781b9a7a450c6`
SHA256	`780acc413de67b0994c96136cbb7841724f4e5104c71f6775ec92409a6a60c1a`
CRC32	`8B7CDA32`
ssdeep	`384:yxJ4297+0y/l360bVS9G4JvxK0q0fLAejNZ7UIepmjgr:gjEtuU4P1fUejHIIepme`
Yara	PE_Header_Zero - PE File Signature Zero Win_Backdoor_AsyncRAT_Zero - Win Backdoor AsyncRAT IsPE32 - (no description) IsNET_EXE - (no description) IsWindowsGUI - (no description)

ugopoundx.exe "C:\Users\test22\AppData\Local\Temp\ugopoundx.exe"
8052

Name	Response	Post-Analysis Lookup
gkfaalkhnkqvgjntywc.ml	A 172.67.187.116 A 104.21.40.169	172.67.187.116

IP Address	Status	Action
104.21.40.169	Active	Moloch
164.124.101.2	Active	Moloch
172.217.25.14	Active	Moloch

Suricata Alerts

Flow	SID	Signature	Category
UDP 192.168.56.102:57660 -> 164.124.101.2:53	2025106	ET INFO DNS Query for Suspicious .ml Domain	Potentially Bad Traffic

Suricata TLS

No Suricata TLS

Queries for the computername (2 events)

Time & API	Arguments	Status	Return	Repeated
GetComputerNameA April 23, 2021, 6:12 p.m.	computer_name: TEST22-PC	1	1	0
GetComputerNameW April 23, 2021, 6:12 p.m.	computer_name: TEST22-PC	1	1	0

Checks if process is being debugged by a debugger (4 events)

Time & API	Arguments	Status	Return	Repeated
IsDebuggerPresent April 23, 2021, 6:12 p.m.			0	0
IsDebuggerPresent April 23, 2021, 6:12 p.m.			0	0
IsDebuggerPresent April 23, 2021, 6:12 p.m.			0	0
IsDebuggerPresent April 23, 2021, 6:12 p.m.			0	0

Uses Windows APIs to generate a cryptographic key (3 events)

Time & API	Arguments	Status	Return
CryptExportKey April 23, 2021, 6:12 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x004e1998 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey April 23, 2021, 6:12 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x004e1a58 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey April 23, 2021, 6:12 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x004e1a58 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1

Checks amount of memory in system, this can be used to detect virtual machines that have a low amount of memory available (1 event)

Time & API	Arguments	Status	Return	Repeated
GlobalMemoryStatusEx April 23, 2021, 6:12 p.m.		1	1	0

HTTP traffic contains suspicious features which may be indicative of malware related traffic (2 events)

suspicious_features	GET method with no useragent header				suspicious_request	GET http://gkfaalkhnkqvgjntywc.ml/liverpool-fc-news/features/steven-gerrard-liverpool-future-dalglish--goal-A1BA11D1E9B15DC564EFEEE3183AB786.html
suspicious_features	GET method with no useragent header				suspicious_request	GET http://gkfaalkhnkqvgjntywc.ml/liverpool-fc-news/features/steven-gerrard-liverpool-future-dalglish--goal-B8B78C1637D77CC52B8736BB575F7F4D.html

Performs some HTTP requests (2 events)

request	GET http://gkfaalkhnkqvgjntywc.ml/liverpool-fc-news/features/steven-gerrard-liverpool-future-dalglish--goal-A1BA11D1E9B15DC564EFEEE3183AB786.html
request	GET http://gkfaalkhnkqvgjntywc.ml/liverpool-fc-news/features/steven-gerrard-liverpool-future-dalglish--goal-B8B78C1637D77CC52B8736BB575F7F4D.html

Allocates read-write-execute memory (usually to unpack itself) (20 events)

Time & API	Arguments	Status
NtAllocateVirtualMemory April 23, 2021, 6:12 p.m.	process_identifier: 8052 region_size: 393216 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x003f0000 allocation_type: 8192 (MEM_RESERVE) process_handle: 0xffffffff	1
NtAllocateVirtualMemory April 23, 2021, 6:12 p.m.	process_identifier: 8052 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00410000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtProtectVirtualMemory April 23, 2021, 6:12 p.m.	process_identifier: 8052 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x6fba1000 process_handle: 0xffffffff	1
NtProtectVirtualMemory April 23, 2021, 6:12 p.m.	process_identifier: 8052 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x6fba2000 process_handle: 0xffffffff	1
NtAllocateVirtualMemory April 23, 2021, 6:12 p.m.	process_identifier: 8052 region_size: 1769472 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00b20000 allocation_type: 8192 (MEM_RESERVE) process_handle: 0xffffffff	1
NtAllocateVirtualMemory April 23, 2021, 6:12 p.m.	process_identifier: 8052 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00c90000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory April 23, 2021, 6:12 p.m.	process_identifier: 8052 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00462000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory April 23, 2021, 6:12 p.m.	process_identifier: 8052 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0047c000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory April 23, 2021, 6:12 p.m.	process_identifier: 8052 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00660000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory April 23, 2021, 6:12 p.m.	process_identifier: 8052 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00595000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory April 23, 2021, 6:12 p.m.	process_identifier: 8052 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0059b000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory April 23, 2021, 6:12 p.m.	process_identifier: 8052 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00597000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory April 23, 2021, 6:12 p.m.	process_identifier: 8052 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00486000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory April 23, 2021, 6:12 p.m.	process_identifier: 8052 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0046a000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory April 23, 2021, 6:12 p.m.	process_identifier: 8052 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0048a000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory April 23, 2021, 6:12 p.m.	process_identifier: 8052 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00487000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory April 23, 2021, 6:12 p.m.	process_identifier: 8052 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0047a000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory April 23, 2021, 6:12 p.m.	process_identifier: 8052 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0048b000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory April 23, 2021, 6:12 p.m.	process_identifier: 8052 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00661000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory April 23, 2021, 6:12 p.m.	process_identifier: 8052 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0046c000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1

Checks adapter addresses which can be used to detect virtual network interfaces (1 event)

Time & API	Arguments	Status	Return	Repeated
GetAdaptersAddresses April 23, 2021, 6:12 p.m.	flags: 15 family: 0		111	0

Communicates with host for which no DNS query was performed (1 event)

host

172.217.25.14

File has been identified by 13 AntiVirus engines on VirusTotal as malicious (13 events)

Elastic	malicious (high confidence)
FireEye	Generic.mg.b0ea02e59dcda980
Cylance	Unsafe
Sangfor	Trojan.Win32.Save.a
CrowdStrike	win/malicious_confidence_70% (D)
BitDefenderTheta	Gen:NN.ZemsilF.34678.bm0@aWEvCJbi
ESET-NOD32	a variant of MSIL/TrojanDownloader.Agent.HUL
APEX	Malicious
Avast	Win32:RATX-gen [Trj]
McAfee-GW-Edition	Artemis!Trojan
McAfee	Artemis!B0EA02E59DCD
SentinelOne	Static AI - Malicious PE
AVG	Win32:RATX-gen [Trj]

ugopoundx.exe

Process Tree Toggle all

Network Toggle all

Suricata Toggle all

Suricata Alerts

Suricata TLS

Signatures Toggle All