Favorites
Tools
Dr.Zero Chatbot
Notifications
Guide 2020-06-10
Version history 2020-06-10

Summary | ZeroBOX

ABU.exe

PE32 PE File

Category	Machine	Started	Completed
FILE	s1_win7_x6402	May 20, 2021, 7:30 a.m.	May 20, 2021, 7:33 a.m.

Size	85.7KB
Type	PE32 executable (GUI) Intel 80386, for MS Windows
MD5	`47de54f1f21a47cbabe3b547d041da92`
SHA256	`7c6dd17771211be442869aeda17f074919f7f81149b36aa92006b8ae40dd2dd0`
CRC32	`927498C6`
ssdeep	`768:yTHsZVuoTHvtubTrTHTV+4l6tWir4HudV0fkpaEaN5swYRfFwjFCLQhSELOg12W:aMZZUDV+4l6/dCcpaEWEM4ELOg1z`
Yara	PE_Header_Zero - PE File Signature IsPE32 - (no description)

ABU.exe "C:\Users\test22\AppData\Local\Temp\ABU.exe"
900
- ABU.exe "C:\Users\test22\AppData\Local\Temp\ABU.exe"
  6952

Name	Response	Post-Analysis Lookup
No hosts contacted.

IP Address	Status	Action
172.217.25.14	Active	Moloch

Suricata Alerts

No Suricata Alerts

Suricata TLS

No Suricata TLS

Allocates read-write-execute memory (usually to unpack itself) (4 events)

Time & API	Arguments	Status	Return	Repeated
NtProtectVirtualMemory May 20, 2021, 7:30 a.m.	process_identifier: 900 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x73772000 process_handle: 0xffffffff	1	0	0
NtAllocateVirtualMemory May 20, 2021, 7:31 a.m.	process_identifier: 900 region_size: 49152 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x004e0000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1	0	0
NtProtectVirtualMemory May 20, 2021, 7:31 a.m.	process_identifier: 900 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 876544 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x773b0000 process_handle: 0xffffffff	1	0	0
NtProtectVirtualMemory May 20, 2021, 7:31 a.m.	process_identifier: 6952 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 876544 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x773b0000 process_handle: 0xffffffff	1	0	0

Changes read-write memory protection to read-execute (probably to avoid detection when setting all RWX flags at the same time) (1 event)

Time & API	Arguments	Status	Return	Repeated
NtProtectVirtualMemory May 20, 2021, 7:30 a.m.	process_identifier: 900 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 length: 24576 protection: 32 (PAGE_EXECUTE_READ) base_address: 0x003f0000 process_handle: 0xffffffff	1	0	0

Communicates with host for which no DNS query was performed (1 event)

host

172.217.25.14

Enumerates services, possibly for anti-virtualization (1 event)

Time & API	Arguments	Status	Return	Repeated
EnumServicesStatusA May 20, 2021, 7:31 a.m.	service_handle: 0x005632a8 service_type: 48 service_status: 3		0	0