Summary | ZeroBOX

Category	Machine	Started	Completed
FILE	s1_win7_x6402	June 3, 2021, 8:56 p.m.	June 3, 2021, 9:05 p.m.

Size	4.9MB
Type	PE32+ executable (GUI) x86-64 Mono/.Net assembly, for MS Windows
MD5	`0b4ab2b8547d9d49b35788f9da74b439`
SHA256	`60e93179fdc24865d5d06c00a6280a224263def03b1d9b081b0edf972ed95ad1`
CRC32	`E5EDA517`
ssdeep	`98304:QbhaIUK+MXPKHfawHXOQTC6gVqAUqxmxlc9c5Pt+Lw1nGosyPS8b3nH0qnQYmrjw:QUIN+6KHfaqUVNfmQe5Pt+Lwa6XHDGrM`
Yara	Win_Backdoor_AsyncRAT_Zero - Win Backdoor AsyncRAT PE_Header_Zero - PE File Signature IsPE64 - (no description)

TT-3.exe "C:\Users\test22\AppData\Local\Temp\TT-3.exe"
4892

Name	Response	Post-Analysis Lookup
No hosts contacted.

IP Address	Status	Action
164.124.101.2	Active	Moloch
172.217.25.14	Active	Moloch

Suricata Alerts

No Suricata Alerts

Suricata TLS

No Suricata TLS

Checks if process is being debugged by a debugger (2 events)

Time & API	Arguments	Status	Return	Repeated
IsDebuggerPresent June 3, 2021, 8:56 p.m.			0	0
IsDebuggerPresent June 3, 2021, 8:56 p.m.			0	0

Collects information to fingerprint the system (MachineGuid, DigitalProductId, SystemBiosDate) (1 event)

registry

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\MachineGuid

Checks amount of memory in system, this can be used to detect virtual machines that have a low amount of memory available (1 event)

Time & API	Arguments	Status	Return	Repeated
GlobalMemoryStatusEx June 3, 2021, 8:56 p.m.		1	1	0

Allocates read-write-execute memory (usually to unpack itself) (43 events)

Time & API	Arguments	Status
NtAllocateVirtualMemory June 3, 2021, 8:56 p.m.	process_identifier: 4892 region_size: 983040 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0000000000e40000 allocation_type: 8192 (MEM_RESERVE) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory June 3, 2021, 8:56 p.m.	process_identifier: 4892 region_size: 8192 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0000000000eb0000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory June 3, 2021, 8:56 p.m.	process_identifier: 4892 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fef23d1000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory June 3, 2021, 8:56 p.m.	process_identifier: 4892 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fef2a6b000 process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory June 3, 2021, 8:56 p.m.	process_identifier: 4892 region_size: 2359296 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00000000029a0000 allocation_type: 8192 (MEM_RESERVE) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory June 3, 2021, 8:56 p.m.	process_identifier: 4892 region_size: 8192 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0000000002b60000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory June 3, 2021, 8:56 p.m.	process_identifier: 4892 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fef23d2000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory June 3, 2021, 8:56 p.m.	process_identifier: 4892 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fef23d2000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory June 3, 2021, 8:56 p.m.	process_identifier: 4892 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fef23d2000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory June 3, 2021, 8:56 p.m.	process_identifier: 4892 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fef23d2000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory June 3, 2021, 8:56 p.m.	process_identifier: 4892 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fef23d2000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory June 3, 2021, 8:56 p.m.	process_identifier: 4892 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fef23d2000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory June 3, 2021, 8:56 p.m.	process_identifier: 4892 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fef23d2000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory June 3, 2021, 8:56 p.m.	process_identifier: 4892 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fef23d2000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory June 3, 2021, 8:56 p.m.	process_identifier: 4892 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fef23d2000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory June 3, 2021, 8:56 p.m.	process_identifier: 4892 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fef23d2000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory June 3, 2021, 8:56 p.m.	process_identifier: 4892 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fef23d2000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory June 3, 2021, 8:56 p.m.	process_identifier: 4892 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fef23d4000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory June 3, 2021, 8:56 p.m.	process_identifier: 4892 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fef23d4000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory June 3, 2021, 8:56 p.m.	process_identifier: 4892 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fef23d4000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory June 3, 2021, 8:56 p.m.	process_identifier: 4892 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fef23d4000 process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory June 3, 2021, 8:56 p.m.	process_identifier: 4892 region_size: 655360 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fffff10000 allocation_type: 1056768 (MEM_RESERVE\|MEM_TOP_DOWN) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory June 3, 2021, 8:56 p.m.	process_identifier: 4892 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fffff10000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory June 3, 2021, 8:56 p.m.	process_identifier: 4892 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fffff10000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory June 3, 2021, 8:56 p.m.	process_identifier: 4892 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fffff20000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory June 3, 2021, 8:56 p.m.	process_identifier: 4892 region_size: 65536 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fffff00000 allocation_type: 1056768 (MEM_RESERVE\|MEM_TOP_DOWN) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory June 3, 2021, 8:56 p.m.	process_identifier: 4892 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fffff00000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory June 3, 2021, 8:56 p.m.	process_identifier: 4892 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fe92c2a000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory June 3, 2021, 8:56 p.m.	process_identifier: 4892 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fe92cdc000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory June 3, 2021, 8:56 p.m.	process_identifier: 4892 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fe92d06000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory June 3, 2021, 8:56 p.m.	process_identifier: 4892 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fe92ce0000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory June 3, 2021, 8:56 p.m.	process_identifier: 4892 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fe92c3c000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory June 3, 2021, 8:56 p.m.	process_identifier: 4892 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fe92d50000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory June 3, 2021, 8:56 p.m.	process_identifier: 4892 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fe92c4b000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory June 3, 2021, 8:56 p.m.	process_identifier: 4892 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fe92c2b000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory June 3, 2021, 8:56 p.m.	process_identifier: 4892 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fe92c7c000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory June 3, 2021, 8:56 p.m.	process_identifier: 4892 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fe92c4d000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory June 3, 2021, 8:56 p.m.	process_identifier: 4892 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fe92c22000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory June 3, 2021, 8:56 p.m.	process_identifier: 4892 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fe92da0000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory June 3, 2021, 8:56 p.m.	process_identifier: 4892 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fe92c3a000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory June 3, 2021, 8:56 p.m.	process_identifier: 4892 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fe92d51000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory June 3, 2021, 8:56 p.m.	process_identifier: 4892 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fe92c2c000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory June 3, 2021, 8:56 p.m.	process_identifier: 4892 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fe92d52000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1

The binary likely contains encrypted or compressed data indicative of a packer (2 events)

section

{u'size_of_data': u'0x004c3400', u'virtual_address': u'0x00002000', u'entropy': 7.998642083800367, u'name': u'.text', u'virtual_size': u'0x004c3400'}

entropy

7.9986420838

description

A section with a high entropy has been found

entropy

0.966891356067

description

Overall entropy of this PE file is high

Checks for the Locally Unique Identifier on the system for a suspicious privilege (1 event)

Time & API	Arguments	Status	Return	Repeated
LookupPrivilegeValueW June 3, 2021, 8:56 p.m.	system_name: privilege_name: SeDebugPrivilege	1	1	0

Communicates with host for which no DNS query was performed (1 event)

host

172.217.25.14

File has been identified by 38 AntiVirus engines on VirusTotal as malicious (38 events)

Elastic	malicious (high confidence)
MicroWorld-eScan	Trojan.GenericKD.46379142
FireEye	Generic.mg.0b4ab2b8547d9d49
McAfee	Artemis!0B4AB2B8547D
Cylance	Unsafe
Sangfor	Trojan.MSIL.Seraph.gen
K7AntiVirus	Trojan ( 0057d5301 )
Alibaba	TrojanDownloader:MSIL/Kryptik.802073ea
K7GW	Trojan ( 0057d5301 )
Symantec	Trojan.Gen.MBT
ESET-NOD32	a variant of MSIL/Kryptik.ABEV
APEX	Malicious
Avast	FileRepMalware
Kaspersky	HEUR:Trojan-Downloader.MSIL.Seraph.gen
BitDefender	Trojan.GenericKD.46379142
Paloalto	generic.ml
Ad-Aware	Trojan.GenericKD.46379142
Sophos	Mal/Generic-S
DrWeb	Trojan.PackedNET.783
VIPRE	Trojan.Win32.Generic!BT
TrendMicro	TROJ_GEN.R002C0WEV21
McAfee-GW-Edition	Artemis!Trojan
Emsisoft	Trojan.GenericKD.46379142 (B)
SentinelOne	Static AI - Suspicious PE
Webroot	W32.Trojan.Gen
Avira	TR/Redcap.yfqso
Microsoft	Trojan:Win32/AgentTesla!ml
Gridinsoft	Trojan.Win64.Downloader.vb
GData	MSIL.Trojan.BSE.XNY6ZA
Cynet	Malicious (score: 100)
VBA32	TrojanDownloader.MSIL.Seraph
MAX	malware (ai score=86)
TrendMicro-HouseCall	TROJ_GEN.R002C0WEV21
Ikarus	Trojan.SuspectCRC
Fortinet	PossibleThreat.PALLASNET.H
AVG	FileRepMalware
Panda	Trj/CI.A
CrowdStrike	win/malicious_confidence_80% (W)

TT-3.exe

Process Tree Toggle all

Network Toggle all

Suricata Toggle all

Suricata Alerts

Suricata TLS

Signatures Toggle All