Favorites
Tools
Dr.Zero Chatbot
Notifications
Guide 2020-06-10
Version history 2020-06-10

Summary | ZeroBOX

zamad.exe

PE32 PE File

Category	Machine	Started	Completed
FILE	s1_win7_x6402	May 18, 2021, 5:45 p.m.	May 18, 2021, 5:47 p.m.

Size	164.0KB
Type	PE32 executable (GUI) Intel 80386, for MS Windows
MD5	`3c2482a62a3b2b09cf1f8006acc0e636`
SHA256	`9ee3d5f175896f9734b2e20b029994af328d4048d3412d258a5ae731c2610c56`
CRC32	`59C66669`
ssdeep	`3072:30mhWcaZLDS+qnL/iRCQZolrh1nBYpTI4GiPlsEZh4jjYuEXTp4:308WnfqnLKD2lbnqpAiPlsEZh4jjYhXt`
Yara	PE_Header_Zero - PE File Signature IsPE32 - (no description)

zamad.exe "C:\Users\test22\AppData\Local\Temp\zamad.exe"
4244

Name	Response	Post-Analysis Lookup
No hosts contacted.

IP Address	Status	Action
172.217.25.14	Active	Moloch

Suricata Alerts

No Suricata Alerts

Suricata TLS

No Suricata TLS

Checks amount of memory in system, this can be used to detect virtual machines that have a low amount of memory available (1 event)

Time & API	Arguments	Status	Return	Repeated
GlobalMemoryStatusEx May 18, 2021, 5:45 p.m.		1	1	0

Allocates read-write-execute memory (usually to unpack itself) (3 events)

Time & API	Arguments	Status	Return	Repeated
NtProtectVirtualMemory May 18, 2021, 5:45 p.m.	process_identifier: 4244 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x73772000 process_handle: 0xffffffff	1	0	0
NtAllocateVirtualMemory May 18, 2021, 5:45 p.m.	process_identifier: 4244 region_size: 53248 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x01fb0000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1	0	0
NtProtectVirtualMemory May 18, 2021, 5:45 p.m.	process_identifier: 4244 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 876544 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x773b0000 process_handle: 0xffffffff	1	0	0

Changes read-write memory protection to read-execute (probably to avoid detection when setting all RWX flags at the same time) (1 event)

Time & API	Arguments	Status	Return	Repeated
NtProtectVirtualMemory May 18, 2021, 5:45 p.m.	process_identifier: 4244 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 length: 24576 protection: 32 (PAGE_EXECUTE_READ) base_address: 0x003e0000 process_handle: 0xffffffff	1	0	0

Communicates with host for which no DNS query was performed (1 event)

host

172.217.25.14

File has been identified by 11 AntiVirus engines on VirusTotal as malicious (11 events)

Bkav	W32.AIDetect.malware2
Elastic	malicious (high confidence)
Cylance	Unsafe
Sangfor	Trojan.Win32.Save.a
APEX	Malicious
Kaspersky	UDS:DangerousObject.Multi.Generic
McAfee-GW-Edition	BehavesLike.Win32.Downloader.cm
ZoneAlarm	UDS:DangerousObject.Multi.Generic
Microsoft	Trojan:Win32/Wacatac.B!ml
SentinelOne	Static AI - Suspicious PE
BitDefenderTheta	Gen:NN.ZevbaF.34690.km0@augtLQei