Summary | ZeroBOX

Category	Machine	Started	Completed
FILE	s1_win7_x6402	May 4, 2021, 11:09 a.m.	May 4, 2021, 11:11 a.m.

Size	943.5KB
Type	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
MD5	`be5e95f01666864d42d22044ae372f52`
SHA256	`20287ad0583b58860d095398c2b8e86eea6ec599470ddfe95117f71c4e5fcc99`
CRC32	`6261C131`
ssdeep	`12288:OzoZ9jpxcrXN9ziq+WYTlN9RILOyrf9oasiZR4Df4Kd8kLqT69jKUlLDkwKnM:FNMr32q+WYTf9RohZ2su8kuTEtrc`
Yara	Malicious_Library_Zero - Malicious_Library Is_DotNET_EXE - (no description) PE_Header_Zero - PE File Signature IsPE32 - (no description)

3DfqE7CuHdKNm2P.exe "C:\Users\test22\AppData\Local\Temp\3DfqE7CuHdKNm2P.exe"
7748

Name	Response	Post-Analysis Lookup
No hosts contacted.

IP Address	Status	Action
172.217.25.14	Active	Moloch

Suricata Alerts

No Suricata Alerts

Suricata TLS

No Suricata TLS

Checks if process is being debugged by a debugger (2 events)

Time & API	Arguments	Status	Return	Repeated
IsDebuggerPresent May 4, 2021, 11:09 a.m.			0	0
IsDebuggerPresent May 4, 2021, 11:09 a.m.			0	0

Uses Windows APIs to generate a cryptographic key (3 events)

Time & API	Arguments	Status	Return
CryptExportKey May 4, 2021, 11:11 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x0059cab0 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey May 4, 2021, 11:11 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x0059c3b0 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey May 4, 2021, 11:11 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x0059c3b0 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1

Checks amount of memory in system, this can be used to detect virtual machines that have a low amount of memory available (1 event)

Time & API	Arguments	Status	Return	Repeated
GlobalMemoryStatusEx May 4, 2021, 11:09 a.m.		1	1	0

Allocates read-write-execute memory (usually to unpack itself) (50 out of 74 events)

Time & API	Arguments	Status	Return
NtAllocateVirtualMemory May 4, 2021, 11:09 a.m.	process_identifier: 7748 region_size: 2293760 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00b40000 allocation_type: 8192 (MEM_RESERVE) process_handle: 0xffffffff	1	0
NtAllocateVirtualMemory May 4, 2021, 11:09 a.m.	process_identifier: 7748 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00d30000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1	0
NtProtectVirtualMemory May 4, 2021, 11:09 a.m.	process_identifier: 7748 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x6fba1000 process_handle: 0xffffffff	1	0
NtProtectVirtualMemory May 4, 2021, 11:09 a.m.	process_identifier: 7748 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x6fba2000 process_handle: 0xffffffff	1	0
NtAllocateVirtualMemory May 4, 2021, 11:09 a.m.	process_identifier: 7748 region_size: 393216 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00480000 allocation_type: 8192 (MEM_RESERVE) process_handle: 0xffffffff	1	0
NtAllocateVirtualMemory May 4, 2021, 11:09 a.m.	process_identifier: 7748 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x004a0000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1	0
NtAllocateVirtualMemory May 4, 2021, 11:09 a.m.	process_identifier: 7748 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00392000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1	0
NtAllocateVirtualMemory May 4, 2021, 11:09 a.m.	process_identifier: 7748 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x003d5000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1	0
NtAllocateVirtualMemory May 4, 2021, 11:09 a.m.	process_identifier: 7748 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x003db000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1	0
NtAllocateVirtualMemory May 4, 2021, 11:09 a.m.	process_identifier: 7748 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x003d7000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1	0
NtAllocateVirtualMemory May 4, 2021, 11:09 a.m.	process_identifier: 7748 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x003bc000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1	0
NtAllocateVirtualMemory May 4, 2021, 11:09 a.m.	process_identifier: 7748 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00710000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1	0
NtAllocateVirtualMemory May 4, 2021, 11:09 a.m.	process_identifier: 7748 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0039a000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1	0
NtAllocateVirtualMemory May 4, 2021, 11:09 a.m.	process_identifier: 7748 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x003ca000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1	0
NtAllocateVirtualMemory May 4, 2021, 11:09 a.m.	process_identifier: 7748 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x003c7000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1	0
NtAllocateVirtualMemory May 4, 2021, 11:09 a.m.	process_identifier: 7748 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x003ba000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1	0
NtAllocateVirtualMemory May 4, 2021, 11:09 a.m.	process_identifier: 7748 region_size: 327680 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x7ef50000 allocation_type: 1056768 (MEM_RESERVE\|MEM_TOP_DOWN) process_handle: 0xffffffff	1	0
NtAllocateVirtualMemory May 4, 2021, 11:09 a.m.	process_identifier: 7748 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x7ef50000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1	0
NtAllocateVirtualMemory May 4, 2021, 11:09 a.m.	process_identifier: 7748 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x7ef50000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1	0
NtAllocateVirtualMemory May 4, 2021, 11:09 a.m.	process_identifier: 7748 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x7ef58000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1	0
NtAllocateVirtualMemory May 4, 2021, 11:09 a.m.	process_identifier: 7748 region_size: 65536 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x7ef40000 allocation_type: 1056768 (MEM_RESERVE\|MEM_TOP_DOWN) process_handle: 0xffffffff	1	0
NtAllocateVirtualMemory May 4, 2021, 11:09 a.m.	process_identifier: 7748 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x7ef40000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1	0
NtProtectVirtualMemory May 4, 2021, 11:09 a.m.	process_identifier: 7748 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x73772000 process_handle: 0xffffffff	1	0
NtAllocateVirtualMemory May 4, 2021, 11:09 a.m.	process_identifier: 7748 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00711000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1	0
NtAllocateVirtualMemory May 4, 2021, 11:09 a.m.	process_identifier: 7748 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x003c6000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1	0
NtAllocateVirtualMemory May 4, 2021, 11:09 a.m.	process_identifier: 7748 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00712000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1	0
NtAllocateVirtualMemory May 4, 2021, 11:11 a.m.	process_identifier: 7748 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x003bd000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1	0
NtAllocateVirtualMemory May 4, 2021, 11:11 a.m.	process_identifier: 7748 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00713000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1	0
NtAllocateVirtualMemory May 4, 2021, 11:11 a.m.	process_identifier: 7748 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00714000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1	0
NtAllocateVirtualMemory May 4, 2021, 11:11 a.m.	process_identifier: 7748 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00715000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1	0
NtAllocateVirtualMemory May 4, 2021, 11:11 a.m.	process_identifier: 7748 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00716000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1	0
NtAllocateVirtualMemory May 4, 2021, 11:11 a.m.	process_identifier: 7748 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00717000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1	0
NtAllocateVirtualMemory May 4, 2021, 11:11 a.m.	process_identifier: 7748 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00718000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1	0
NtAllocateVirtualMemory May 4, 2021, 11:11 a.m.	process_identifier: 7748 region_size: 12288 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00719000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1	0
NtProtectVirtualMemory May 4, 2021, 11:11 a.m.	process_identifier: 7748 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 8 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x04f50178 process_handle: 0xffffffff		3221225550
NtProtectVirtualMemory May 4, 2021, 11:11 a.m.	process_identifier: 7748 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 8 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x04f501a0 process_handle: 0xffffffff		3221225550
NtProtectVirtualMemory May 4, 2021, 11:11 a.m.	process_identifier: 7748 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 8 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x04f501c8 process_handle: 0xffffffff		3221225550
NtProtectVirtualMemory May 4, 2021, 11:11 a.m.	process_identifier: 7748 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 11 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x04fc681e process_handle: 0xffffffff		3221225550
NtProtectVirtualMemory May 4, 2021, 11:11 a.m.	process_identifier: 7748 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 11 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x04fc6812 process_handle: 0xffffffff		3221225550
NtProtectVirtualMemory May 4, 2021, 11:11 a.m.	process_identifier: 7748 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 72 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x04f50208 process_handle: 0xffffffff		3221225550
NtProtectVirtualMemory May 4, 2021, 11:11 a.m.	process_identifier: 7748 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x04fa00e8 process_handle: 0xffffffff		3221225550
NtProtectVirtualMemory May 4, 2021, 11:11 a.m.	process_identifier: 7748 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 8 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x04fa010c process_handle: 0xffffffff		3221225550
NtProtectVirtualMemory May 4, 2021, 11:11 a.m.	process_identifier: 7748 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x04fa0114 process_handle: 0xffffffff		3221225550
NtProtectVirtualMemory May 4, 2021, 11:11 a.m.	process_identifier: 7748 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 8 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x04fa0118 process_handle: 0xffffffff		3221225550
NtProtectVirtualMemory May 4, 2021, 11:11 a.m.	process_identifier: 7748 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x04fa0120 process_handle: 0xffffffff		3221225550
NtProtectVirtualMemory May 4, 2021, 11:11 a.m.	process_identifier: 7748 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x04fa0124 process_handle: 0xffffffff		3221225550
NtProtectVirtualMemory May 4, 2021, 11:11 a.m.	process_identifier: 7748 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x04fa0128 process_handle: 0xffffffff		3221225550
NtProtectVirtualMemory May 4, 2021, 11:11 a.m.	process_identifier: 7748 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 8 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x04fa012c process_handle: 0xffffffff		3221225550
NtProtectVirtualMemory May 4, 2021, 11:11 a.m.	process_identifier: 7748 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x04fa0134 process_handle: 0xffffffff		3221225550
NtProtectVirtualMemory May 4, 2021, 11:11 a.m.	process_identifier: 7748 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 8 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x04fa0138 process_handle: 0xffffffff		3221225550

The binary likely contains encrypted or compressed data indicative of a packer (2 events)

section

{u'size_of_data': u'0x000eb200', u'virtual_address': u'0x00002000', u'entropy': 7.388792817834427, u'name': u'.text', u'virtual_size': u'0x000eb01c'}

entropy

7.38879281783

description

A section with a high entropy has been found

entropy

0.997348886532

description

Overall entropy of this PE file is high

Communicates with host for which no DNS query was performed (1 event)

host

172.217.25.14

File has been identified by 27 AntiVirus engines on VirusTotal as malicious (27 events)

Elastic	malicious (high confidence)
DrWeb	Trojan.PackedNET.624
Cylance	Unsafe
Alibaba	Trojan:Win32/starter.ali1000139
K7GW	Trojan ( 0057bd371 )
Cyren	W32/MSIL_Kryptik.EDK.gen!Eldorado
Symantec	Trojan.Gen.MBT
ESET-NOD32	a variant of MSIL/Kryptik.AARY
APEX	Malicious
Avast	Win32:PWSX-gen [Trj]
Kaspersky	HEUR:Trojan.MSIL.Taskun.gen
Paloalto	generic.ml
Sophos	Mal/Generic-S
McAfee-GW-Edition	Artemis!Trojan
SentinelOne	Static AI - Malicious PE
MAX	malware (ai score=99)
Microsoft	Trojan:MSIL/Agentesla.RT!MTB
AegisLab	Trojan.Multi.Generic.4!c
GData	MSIL.Trojan-Spy.Keylogger404.8KCDKY
Cynet	Malicious (score: 100)
McAfee	Artemis!BE5E95F01666
Malwarebytes	Malware.AI.4134295424
Rising	Trojan.Kryptik!8.8 (CLOUD)
MaxSecure	Trojan.Malware.300983.susgen
Fortinet	MSIL/Kryptik.AARD!tr
Webroot	W32.Trojan.Gen
AVG	Win32:PWSX-gen [Trj]

3DfqE7CuHdKNm2P.exe

Process Tree Toggle all

Network Toggle all

Suricata Toggle all

Suricata Alerts

Suricata TLS

Signatures Toggle All