Summary | ZeroBOX

Category	Machine	Started	Completed
FILE	s1_win7_x6402	April 29, 2021, 10:26 a.m.	April 29, 2021, 10:45 a.m.

Size	966.5KB
Type	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
MD5	`bac325b105737193d6a70fdf897ebb4b`
SHA256	`6436dddd6a03e54be43dc4af92fe5e13243188084c8fce891ce31a2b002c8156`
CRC32	`0F751289`
ssdeep	`24576:gYiJbaiJbxiJbZFcrx4u6W9qOlq4aKjQaa9o9wdBj3iKbl:gYiJWiJNiJ1Fcrx4u6WMOlq3gQaG9dBv`
Yara	Win32_Trojan_PWS_Net_1_Zero - Win32 Trojan PWS .NET Azorult PE_Header_Zero - PE File Signature IsPE32 - (no description) Is_DotNET_EXE - (no description) Malicious_Library_Zero - Malicious_Library Win_Backdoor_AsyncRAT_Zero - Win Backdoor AsyncRAT

z77BwJ1HRskq4Rt.exe "C:\Users\test22\AppData\Local\Temp\z77BwJ1HRskq4Rt.exe"
8768

Name	Response	Post-Analysis Lookup
No hosts contacted.

IP Address	Status	Action
104.21.19.200	Active	Moloch
172.217.25.14	Active	Moloch

Suricata Alerts

No Suricata Alerts

Suricata TLS

No Suricata TLS

Checks if process is being debugged by a debugger (2 events)

Time & API	Arguments	Status	Return	Repeated
IsDebuggerPresent April 29, 2021, 10:26 a.m.			0	0
IsDebuggerPresent April 29, 2021, 10:26 a.m.			0	0

Uses Windows APIs to generate a cryptographic key (3 events)

Time & API	Arguments	Status	Return
CryptExportKey April 29, 2021, 10:28 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x004b6ab0 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey April 29, 2021, 10:28 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x004b63b0 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey April 29, 2021, 10:28 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x004b63b0 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1

Checks amount of memory in system, this can be used to detect virtual machines that have a low amount of memory available (1 event)

Time & API	Arguments	Status	Return	Repeated
GlobalMemoryStatusEx April 29, 2021, 10:26 a.m.		1	1	0

Allocates read-write-execute memory (usually to unpack itself) (50 out of 71 events)

Time & API	Arguments	Status	Return
NtAllocateVirtualMemory April 29, 2021, 10:26 a.m.	process_identifier: 8768 region_size: 1507328 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x006a0000 allocation_type: 8192 (MEM_RESERVE) process_handle: 0xffffffff	1	0
NtAllocateVirtualMemory April 29, 2021, 10:26 a.m.	process_identifier: 8768 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x007d0000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1	0
NtProtectVirtualMemory April 29, 2021, 10:26 a.m.	process_identifier: 8768 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x6fba1000 process_handle: 0xffffffff	1	0
NtProtectVirtualMemory April 29, 2021, 10:26 a.m.	process_identifier: 8768 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x6fba2000 process_handle: 0xffffffff	1	0
NtAllocateVirtualMemory April 29, 2021, 10:26 a.m.	process_identifier: 8768 region_size: 851968 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00590000 allocation_type: 8192 (MEM_RESERVE) process_handle: 0xffffffff	1	0
NtAllocateVirtualMemory April 29, 2021, 10:26 a.m.	process_identifier: 8768 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00620000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1	0
NtAllocateVirtualMemory April 29, 2021, 10:26 a.m.	process_identifier: 8768 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00422000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1	0
NtAllocateVirtualMemory April 29, 2021, 10:26 a.m.	process_identifier: 8768 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00565000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1	0
NtAllocateVirtualMemory April 29, 2021, 10:26 a.m.	process_identifier: 8768 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0056b000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1	0
NtAllocateVirtualMemory April 29, 2021, 10:26 a.m.	process_identifier: 8768 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00567000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1	0
NtAllocateVirtualMemory April 29, 2021, 10:26 a.m.	process_identifier: 8768 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0044c000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1	0
NtAllocateVirtualMemory April 29, 2021, 10:26 a.m.	process_identifier: 8768 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x007a0000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1	0
NtAllocateVirtualMemory April 29, 2021, 10:26 a.m.	process_identifier: 8768 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0042a000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1	0
NtAllocateVirtualMemory April 29, 2021, 10:26 a.m.	process_identifier: 8768 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0045a000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1	0
NtAllocateVirtualMemory April 29, 2021, 10:26 a.m.	process_identifier: 8768 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00457000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1	0
NtAllocateVirtualMemory April 29, 2021, 10:26 a.m.	process_identifier: 8768 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0044a000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1	0
NtAllocateVirtualMemory April 29, 2021, 10:26 a.m.	process_identifier: 8768 region_size: 327680 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x7ef50000 allocation_type: 1056768 (MEM_RESERVE\|MEM_TOP_DOWN) process_handle: 0xffffffff	1	0
NtAllocateVirtualMemory April 29, 2021, 10:26 a.m.	process_identifier: 8768 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x7ef50000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1	0
NtAllocateVirtualMemory April 29, 2021, 10:26 a.m.	process_identifier: 8768 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x7ef50000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1	0
NtAllocateVirtualMemory April 29, 2021, 10:26 a.m.	process_identifier: 8768 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x7ef58000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1	0
NtAllocateVirtualMemory April 29, 2021, 10:26 a.m.	process_identifier: 8768 region_size: 65536 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x7ef40000 allocation_type: 1056768 (MEM_RESERVE\|MEM_TOP_DOWN) process_handle: 0xffffffff	1	0
NtAllocateVirtualMemory April 29, 2021, 10:26 a.m.	process_identifier: 8768 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x7ef40000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1	0
NtProtectVirtualMemory April 29, 2021, 10:26 a.m.	process_identifier: 8768 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x73772000 process_handle: 0xffffffff	1	0
NtAllocateVirtualMemory April 29, 2021, 10:26 a.m.	process_identifier: 8768 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x007a1000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1	0
NtAllocateVirtualMemory April 29, 2021, 10:28 a.m.	process_identifier: 8768 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0044d000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1	0
NtAllocateVirtualMemory April 29, 2021, 10:28 a.m.	process_identifier: 8768 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x007a2000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1	0
NtAllocateVirtualMemory April 29, 2021, 10:28 a.m.	process_identifier: 8768 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x007a3000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1	0
NtAllocateVirtualMemory April 29, 2021, 10:28 a.m.	process_identifier: 8768 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x007a4000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1	0
NtAllocateVirtualMemory April 29, 2021, 10:28 a.m.	process_identifier: 8768 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x007a5000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1	0
NtAllocateVirtualMemory April 29, 2021, 10:28 a.m.	process_identifier: 8768 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x007a6000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1	0
NtAllocateVirtualMemory April 29, 2021, 10:28 a.m.	process_identifier: 8768 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x007a7000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1	0
NtAllocateVirtualMemory April 29, 2021, 10:28 a.m.	process_identifier: 8768 region_size: 12288 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x007a8000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1	0
NtProtectVirtualMemory April 29, 2021, 10:28 a.m.	process_identifier: 8768 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 8 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x050d0178 process_handle: 0xffffffff		3221225550
NtProtectVirtualMemory April 29, 2021, 10:28 a.m.	process_identifier: 8768 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 8 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x050d01a0 process_handle: 0xffffffff		3221225550
NtProtectVirtualMemory April 29, 2021, 10:28 a.m.	process_identifier: 8768 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 8 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x050d01c8 process_handle: 0xffffffff		3221225550
NtProtectVirtualMemory April 29, 2021, 10:28 a.m.	process_identifier: 8768 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 11 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0514878e process_handle: 0xffffffff		3221225550
NtProtectVirtualMemory April 29, 2021, 10:28 a.m.	process_identifier: 8768 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 11 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x05148782 process_handle: 0xffffffff		3221225550
NtProtectVirtualMemory April 29, 2021, 10:28 a.m.	process_identifier: 8768 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 72 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x050d0208 process_handle: 0xffffffff		3221225550
NtProtectVirtualMemory April 29, 2021, 10:28 a.m.	process_identifier: 8768 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x051220f0 process_handle: 0xffffffff		3221225550
NtProtectVirtualMemory April 29, 2021, 10:28 a.m.	process_identifier: 8768 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 8 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x05122114 process_handle: 0xffffffff		3221225550
NtProtectVirtualMemory April 29, 2021, 10:28 a.m.	process_identifier: 8768 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0512211c process_handle: 0xffffffff		3221225550
NtProtectVirtualMemory April 29, 2021, 10:28 a.m.	process_identifier: 8768 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 8 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x05122120 process_handle: 0xffffffff		3221225550
NtProtectVirtualMemory April 29, 2021, 10:28 a.m.	process_identifier: 8768 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x05122128 process_handle: 0xffffffff		3221225550
NtProtectVirtualMemory April 29, 2021, 10:28 a.m.	process_identifier: 8768 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0512212c process_handle: 0xffffffff		3221225550
NtProtectVirtualMemory April 29, 2021, 10:28 a.m.	process_identifier: 8768 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x05122130 process_handle: 0xffffffff		3221225550
NtProtectVirtualMemory April 29, 2021, 10:28 a.m.	process_identifier: 8768 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 8 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x05122134 process_handle: 0xffffffff		3221225550
NtProtectVirtualMemory April 29, 2021, 10:28 a.m.	process_identifier: 8768 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0512213c process_handle: 0xffffffff		3221225550
NtProtectVirtualMemory April 29, 2021, 10:28 a.m.	process_identifier: 8768 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 8 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x05122140 process_handle: 0xffffffff		3221225550
NtProtectVirtualMemory April 29, 2021, 10:28 a.m.	process_identifier: 8768 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x05122148 process_handle: 0xffffffff		3221225550
NtProtectVirtualMemory April 29, 2021, 10:28 a.m.	process_identifier: 8768 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0512214c process_handle: 0xffffffff		3221225550

The binary likely contains encrypted or compressed data indicative of a packer (2 events)

section

{u'size_of_data': u'0x000d8000', u'virtual_address': u'0x00002000', u'entropy': 7.146689880283745, u'name': u'.text', u'virtual_size': u'0x000d7fb4'}

entropy

7.14668988028

description

A section with a high entropy has been found

entropy

0.894409937888

description

Overall entropy of this PE file is high

Communicates with host for which no DNS query was performed (2 events)

host	104.21.19.200
host	172.217.25.14

File has been identified by 35 AntiVirus engines on VirusTotal as malicious (35 events)

MicroWorld-eScan	Trojan.GenericKD.36807515
FireEye	Trojan.GenericKD.36807515
Alibaba	Trojan:Win32/starter.ali1000139
K7GW	Trojan ( 0057b9821 )
K7AntiVirus	Trojan ( 0057b9821 )
Cyren	W32/MSIL_Kryptik.ECA.gen!Eldorado
Symantec	Trojan.Gen.2
ESET-NOD32	a variant of MSIL/Kryptik.AAQT
Avast	Win32:PWSX-gen [Trj]
Kaspersky	HEUR:Trojan.MSIL.Taskun.gen
BitDefender	Trojan.GenericKD.36807515
Paloalto	generic.ml
AegisLab	Trojan.MSIL.Taskun.4!c
Rising	Trojan.Kryptik!8.8 (CLOUD)
Ad-Aware	Trojan.GenericKD.36807515
Emsisoft	Gen:Variant.Bulz.455063 (B)
Comodo	TrojWare.Win32.Agent.xageg@0
DrWeb	Trojan.PackedNET.688
McAfee-GW-Edition	Artemis!Trojan
Sophos	Mal/Generic-S
Ikarus	Trojan.MSIL.Inject
Avira	TR/AD.XetimaLogger.bikix
Kingsoft	Win32.Troj.Undef.(kcloud)
Microsoft	Trojan:Script/Phonzy.B!ml
GData	Trojan.GenericKD.36807515
Cynet	Malicious (score: 99)
AhnLab-V3	Trojan/Win.MSIL.R418216
McAfee	RDN/Generic.dx
MAX	malware (ai score=84)
Malwarebytes	Trojan.Crypt.MSIL
APEX	Malicious
Tencent	Win32.Trojan.Inject.Auto
Fortinet	MSIL/Kryptik.AAQT!tr
AVG	Win32:PWSX-gen [Trj]
Panda	Trj/GdSda.A

z77BwJ1HRskq4Rt.exe

Process Tree Toggle all

Network Toggle all

Suricata Toggle all

Suricata Alerts

Suricata TLS

Signatures Toggle All