Summary | ZeroBOX

Category	Machine	Started	Completed
FILE	s1_win7_x6402	June 4, 2021, 11:30 a.m.	June 4, 2021, 11:32 a.m.

Size	113.0KB
Type	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
MD5	`7e6280c6eb73dff0a99e07c1907f2392`
SHA256	`aceb1fe903267c603ff26e08481f659d5bb8c10c2d8858bd35a21bc95f115824`
CRC32	`6108FFE5`
ssdeep	`1536:M/8cgfLsrMKi/IXkzgWUT3pZVjLn89f3b6TYnj4RZ9D42zeCJ9uDprylXd:XrfLsQKiUkTUT5DCf3bj4REgepdsXd`
Yara	PE_Header_Zero - PE File Signature Is_DotNET_EXE - (no description) IsPE32 - (no description)

Recooouvre.exe "C:\Users\test22\AppData\Local\Temp\Recooouvre.exe"
3576

Name	Response	Post-Analysis Lookup
No hosts contacted.

IP Address	Status	Action
172.217.25.14	Active	Moloch

Suricata Alerts

No Suricata Alerts

Suricata TLS

No Suricata TLS

Queries for the computername (1 event)

Time & API	Arguments	Status	Return	Repeated
GetComputerNameW June 4, 2021, 11:23 a.m.	computer_name: TEST22-PC	1	1	0

Checks if process is being debugged by a debugger (1 event)

Time & API	Arguments	Status	Return	Repeated
IsDebuggerPresent June 4, 2021, 11:23 a.m.			0	0

Collects information to fingerprint the system (MachineGuid, DigitalProductId, SystemBiosDate) (1 event)

registry

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\MachineGuid

Checks amount of memory in system, this can be used to detect virtual machines that have a low amount of memory available (1 event)

Time & API	Arguments	Status	Return	Repeated
GlobalMemoryStatusEx June 4, 2021, 11:23 a.m.		1	1	0

Allocates read-write-execute memory (usually to unpack itself) (50 out of 52 events)

Time & API	Arguments	Status
NtAllocateVirtualMemory June 4, 2021, 11:23 a.m.	process_identifier: 3576 region_size: 1179648 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0000000000670000 allocation_type: 8192 (MEM_RESERVE) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory June 4, 2021, 11:23 a.m.	process_identifier: 3576 region_size: 8192 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0000000000710000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory June 4, 2021, 11:23 a.m.	process_identifier: 3576 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fef24e1000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory June 4, 2021, 11:23 a.m.	process_identifier: 3576 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fef275e000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory June 4, 2021, 11:23 a.m.	process_identifier: 3576 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fef275e000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory June 4, 2021, 11:23 a.m.	process_identifier: 3576 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fef275f000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory June 4, 2021, 11:23 a.m.	process_identifier: 3576 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fef275f000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory June 4, 2021, 11:23 a.m.	process_identifier: 3576 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fef275f000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory June 4, 2021, 11:23 a.m.	process_identifier: 3576 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fef275f000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory June 4, 2021, 11:23 a.m.	process_identifier: 3576 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fef275f000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory June 4, 2021, 11:23 a.m.	process_identifier: 3576 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fef275f000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory June 4, 2021, 11:23 a.m.	process_identifier: 3576 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fef275f000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory June 4, 2021, 11:23 a.m.	process_identifier: 3576 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fef275f000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory June 4, 2021, 11:23 a.m.	process_identifier: 3576 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fef2760000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory June 4, 2021, 11:23 a.m.	process_identifier: 3576 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fef2760000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory June 4, 2021, 11:23 a.m.	process_identifier: 3576 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fef2760000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory June 4, 2021, 11:23 a.m.	process_identifier: 3576 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fef2760000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory June 4, 2021, 11:23 a.m.	process_identifier: 3576 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fef2760000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory June 4, 2021, 11:23 a.m.	process_identifier: 3576 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fef2761000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory June 4, 2021, 11:23 a.m.	process_identifier: 3576 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fef2761000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory June 4, 2021, 11:23 a.m.	process_identifier: 3576 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fef2761000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory June 4, 2021, 11:23 a.m.	process_identifier: 3576 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fef2761000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory June 4, 2021, 11:23 a.m.	process_identifier: 3576 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fef275e000 process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory June 4, 2021, 11:23 a.m.	process_identifier: 3576 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007ff00022000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory June 4, 2021, 11:23 a.m.	process_identifier: 3576 region_size: 589824 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fffff20000 allocation_type: 1056768 (MEM_RESERVE\|MEM_TOP_DOWN) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory June 4, 2021, 11:23 a.m.	process_identifier: 3576 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fffff20000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory June 4, 2021, 11:23 a.m.	process_identifier: 3576 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fffff20000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory June 4, 2021, 11:23 a.m.	process_identifier: 3576 region_size: 65536 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fffff10000 allocation_type: 1056768 (MEM_RESERVE\|MEM_TOP_DOWN) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory June 4, 2021, 11:23 a.m.	process_identifier: 3576 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fffff10000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory June 4, 2021, 11:23 a.m.	process_identifier: 3576 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007ff000da000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory June 4, 2021, 11:23 a.m.	process_identifier: 3576 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007ff00012000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory June 4, 2021, 11:23 a.m.	process_identifier: 3576 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007ff00023000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory June 4, 2021, 11:23 a.m.	process_identifier: 3576 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007ff000ea000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory June 4, 2021, 11:23 a.m.	process_identifier: 3576 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007ff00112000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory June 4, 2021, 11:23 a.m.	process_identifier: 3576 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007ff000ed000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory June 4, 2021, 11:23 a.m.	process_identifier: 3576 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007ff0002c000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory June 4, 2021, 11:23 a.m.	process_identifier: 3576 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007ff00024000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory June 4, 2021, 11:23 a.m.	process_identifier: 3576 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007ff00160000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory June 4, 2021, 11:23 a.m.	process_identifier: 3576 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007ff00161000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory June 4, 2021, 11:23 a.m.	process_identifier: 3576 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007ff0003f000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory June 4, 2021, 11:23 a.m.	process_identifier: 3576 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007ff000db000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory June 4, 2021, 11:23 a.m.	process_identifier: 3576 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007ff00074000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory June 4, 2021, 11:23 a.m.	process_identifier: 3576 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007ff00043000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory June 4, 2021, 11:23 a.m.	process_identifier: 3576 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007ff00025000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory June 4, 2021, 11:23 a.m.	process_identifier: 3576 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007ff00162000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory June 4, 2021, 11:23 a.m.	process_identifier: 3576 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007ff00026000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory June 4, 2021, 11:23 a.m.	process_identifier: 3576 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007ff000d2000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory June 4, 2021, 11:23 a.m.	process_identifier: 3576 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007ff00013000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory June 4, 2021, 11:23 a.m.	process_identifier: 3576 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007ff00075000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory June 4, 2021, 11:23 a.m.	process_identifier: 3576 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007ff001a0000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1

The binary likely contains encrypted or compressed data indicative of a packer (1 event)

section

{u'size_of_data': u'0x00004600', u'virtual_address': u'0x0001a000', u'entropy': 7.723969779081084, u'name': u'.rsrc', u'virtual_size': u'0x000045d8'}

entropy

7.72396977908

description

A section with a high entropy has been found

Communicates with host for which no DNS query was performed (1 event)

host

172.217.25.14

File has been identified by 35 AntiVirus engines on VirusTotal as malicious (35 events)

Elastic	malicious (high confidence)
MicroWorld-eScan	Trojan.GenericKD.46313967
FireEye	Trojan.GenericKD.46313967
CAT-QuickHeal	PUA.YmaccoFC.S20327431
ALYac	Trojan.GenericKD.46313967
Malwarebytes	Adware.Csdimonetize
Sangfor	Adware.Win32.CSDI.gen
K7AntiVirus	Adware ( 00577a001 )
BitDefender	Trojan.GenericKD.46313967
K7GW	Adware ( 00577a001 )
BitDefenderTheta	Gen:NN.ZemsilF.34722.hm0@aiB64xd
Symantec	ML.Attribute.HighConfidence
ESET-NOD32	a variant of MSIL/Adware.CsdiMonetize.BG
APEX	Malicious
Avast	Win32:MalwareX-gen [Trj]
Kaspersky	not-a-virus:HEUR:AdWare.MSIL.CSDI.gen
Alibaba	AdWare:MSIL/CsdiMonetize.ad6bdd13
Ad-Aware	Trojan.GenericKD.46313967
Zillya	Adware.CsdiMonetize.Win32.5173
TrendMicro	TROJ_GEN.R049C0WEL21
MaxSecure	Trojan.Malware.300983.susgen
Avira	HEUR/AGEN.1142317
GData	Trojan.GenericKD.46313967
Cynet	Malicious (score: 100)
AhnLab-V3	Malware/Win32.Generic.C4381839
McAfee	Artemis!7E6280C6EB73
MAX	malware (ai score=83)
VBA32	TScope.Trojan.MSIL
Panda	Trj/GdSda.A
TrendMicro-HouseCall	TROJ_GEN.R049C0WEL21
Yandex	PUA.CSDI!J7SOoP7QKRs
SentinelOne	Static AI - Malicious PE
eGambit	Unsafe.AI_Score_95%
Fortinet	Adware/Csdi
AVG	Win32:MalwareX-gen [Trj]

Recooouvre.exe

Process Tree Toggle all

Network Toggle all

Suricata Toggle all

Suricata Alerts

Suricata TLS

Signatures Toggle All