Favorites
Tools
Dr.Zero Chatbot
Notifications
Guide 2020-06-10
Version history 2020-06-10

latestReport
11.08 05:11
locker.exe
11.08 05:11
PowerView.ps1
11.08 05:11
cred64.dll
11.08 05:11
ngrok.exe
11.08 05:11
CollosalLoader.exe
11.08 05:11
SharpHound.exe
11.08 05:11
Reaper%20cfx%20Spoofer...
11.08 05:11
dxwebsetup.exe
11.08 05:11
hell9o.exe
11.08 05:11
jerniuiopu.exe

Latest News
11.11 05:11
Spam-Anrufe adé: Diese...
11.11 05:11
Bilderkontrolle in Wha...
11.11 05:11
Baguette statt Bitcoin...
11.11 05:11
Beware of the “India P...
11.11 03:11
Component Tester Teardown
11.11 03:11
JPMorgan Braces for ‘I...
11.11 02:11
Zipdump & PKZIP Re...
11.11 12:11
Strom und Heizkosten i...
11.11 12:11
Koffein-Tracking per A...
11.11 12:11
Ryzen 7 9800X3D: AMDs ...

Summary | ZeroBOX

XPP.exe

PE32 PE File

Category	Machine	Started	Completed
FILE	s1_win7_x6402	May 20, 2021, 7:52 a.m.	May 20, 2021, 7:54 a.m.

Size	109.7KB
Type	PE32 executable (GUI) Intel 80386, for MS Windows
MD5	`02767a23a2e6b59b337dee3f44b75f39`
SHA256	`7aac0d666b2552cb06d944ea7c54852070a9434708b221232faff64396b8f70a`
CRC32	`033022C9`
ssdeep	`1536:COPygt/5xAuveMduaM32E49JNRxPQ5stIWiyYoy:CORRxJvjBMmX9fRxPQ5st2yYoy`
Yara	PE_Header_Zero - PE File Signature IsPE32 - (no description)

XPP.exe "C:\Users\test22\AppData\Local\Temp\XPP.exe"
8564
- XPP.exe "C:\Users\test22\AppData\Local\Temp\XPP.exe"
  2120

Name	Response	Post-Analysis Lookup
No hosts contacted.

IP Address	Status	Action
172.217.25.14	Active	Moloch

Suricata Alerts

No Suricata Alerts

Suricata TLS

No Suricata TLS

Allocates read-write-execute memory (usually to unpack itself) (4 events)

Time & API	Arguments	Status	Return	Repeated
NtProtectVirtualMemory May 20, 2021, 7:52 a.m.	process_identifier: 8564 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x73772000 process_handle: 0xffffffff	1	0	0
NtAllocateVirtualMemory May 20, 2021, 7:52 a.m.	process_identifier: 8564 region_size: 49152 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x02710000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1	0	0
NtProtectVirtualMemory May 20, 2021, 7:52 a.m.	process_identifier: 8564 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 876544 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x773b0000 process_handle: 0xffffffff	1	0	0
NtProtectVirtualMemory May 20, 2021, 7:53 a.m.	process_identifier: 2120 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 876544 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x773b0000 process_handle: 0xffffffff	1	0	0

Changes read-write memory protection to read-execute (probably to avoid detection when setting all RWX flags at the same time) (1 event)

Time & API	Arguments	Status	Return	Repeated
NtProtectVirtualMemory May 20, 2021, 7:52 a.m.	process_identifier: 8564 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 length: 24576 protection: 32 (PAGE_EXECUTE_READ) base_address: 0x00380000 process_handle: 0xffffffff	1	0	0

Communicates with host for which no DNS query was performed (1 event)

host

172.217.25.14

Enumerates services, possibly for anti-virtualization (1 event)

Time & API	Arguments	Status	Return	Repeated
EnumServicesStatusA May 20, 2021, 7:53 a.m.	service_handle: 0x00840a58 service_type: 48 service_status: 3		0	0