Summary | ZeroBOX

Category	Machine	Started	Completed
FILE	s1_win7_x6402	June 14, 2021, 1:41 p.m.	June 14, 2021, 2:15 p.m.

Size	26.7KB
Type	ELF 32-bit LSB executable, Renesas SH, version 1 (SYSV), statically linked, stripped
MD5	`34e3ffd55059cbe0f8e3d72d338d06d6`
SHA256	`5b678ac317c5f8c105cf4111f28d9f6d367351cb16bc2b1fc325d7d595c79992`
CRC32	`5BCB6708`
ssdeep	`384:dkh8zQ3WiAPPKcLyuuTGZulxyes8dVZQIt5js/ZXkwW4FTR+lXwoTB/uJqBrCy72:uuQmiaPKc2GZulACVBwXkT6oTBW6CO+`
Yara	IsELF - Executable and Linking Format executable file (Linux/Unix)

cmd.exe "C:\Windows\System32\cmd.exe" /c start /wait "kPTGXaMsE" C:\Users\test22\AppData\Local\Temp\bot.superh
2288
- rundll32.exe "C:\Windows\system32\rundll32.exe" C:\Windows\system32\shell32.dll,OpenAs_RunDLL C:\Users\test22\AppData\Local\Temp\bot.superh
  5776
  - editplus.exe "editplus.exe"
    8948
explorer.exe C:\Windows\Explorer.EXE
1848

Name	Response	Post-Analysis Lookup
No hosts contacted.

IP Address	Status	Action
172.217.25.14	Active	Moloch
51.15.78.68	Active	Moloch

Suricata Alerts

No Suricata Alerts

Suricata TLS

No Suricata TLS

Queries for the computername (2 events)

Time & API	Arguments	Status	Return	Repeated
GetComputerNameW June 14, 2021, 1:34 p.m.	computer_name: TEST22-PC	1	1	0
GetComputerNameW June 14, 2021, 1:34 p.m.	computer_name: TEST22-PC	1	1	0

Checks if process is being debugged by a debugger (2 events)

Time & API	Arguments	Status	Return	Repeated
IsDebuggerPresent June 14, 2021, 1:41 p.m.			0	0
IsDebuggerPresent June 14, 2021, 1:41 p.m.			0	0

Tries to locate where the browsers are installed (1 event)

file	C:\Program Files (x86)\Google\Chrome\Application\chrome.exe

Allocates read-write-execute memory (usually to unpack itself) (13 events)

Time & API	Arguments	Status
NtProtectVirtualMemory June 14, 2021, 1:41 p.m.	process_identifier: 5776 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x73e80000 process_handle: 0xffffffff	1
NtProtectVirtualMemory June 14, 2021, 1:41 p.m.	process_identifier: 5776 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x73771000 process_handle: 0xffffffff	1
NtProtectVirtualMemory June 14, 2021, 1:41 p.m.	process_identifier: 5776 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x73861000 process_handle: 0xffffffff	1
NtProtectVirtualMemory June 14, 2021, 1:41 p.m.	process_identifier: 5776 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x72da4000 process_handle: 0xffffffff	1
NtProtectVirtualMemory June 14, 2021, 1:41 p.m.	process_identifier: 5776 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x73772000 process_handle: 0xffffffff	1
NtProtectVirtualMemory June 14, 2021, 1:41 p.m.	process_identifier: 5776 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x73e01000 process_handle: 0xffffffff	1
NtProtectVirtualMemory June 14, 2021, 1:41 p.m.	process_identifier: 5776 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x72821000 process_handle: 0xffffffff	1
NtProtectVirtualMemory June 14, 2021, 1:41 p.m.	process_identifier: 5776 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x73ef1000 process_handle: 0xffffffff	1
NtProtectVirtualMemory June 14, 2021, 1:41 p.m.	process_identifier: 5776 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x6e621000 process_handle: 0xffffffff	1
NtProtectVirtualMemory June 14, 2021, 1:41 p.m.	process_identifier: 5776 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x73db1000 process_handle: 0xffffffff	1
NtProtectVirtualMemory June 14, 2021, 1:41 p.m.	process_identifier: 5776 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x73dd1000 process_handle: 0xffffffff	1
NtProtectVirtualMemory June 14, 2021, 1:41 p.m.	process_identifier: 5776 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x74e51000 process_handle: 0xffffffff	1
NtProtectVirtualMemory June 14, 2021, 1:41 p.m.	process_identifier: 8948 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x73772000 process_handle: 0xffffffff	1

Queries the disk size which could be used to detect virtual machine with small fixed size or dynamic allocation (1 event)

Time & API	Arguments	Status	Return	Repeated
GetDiskFreeSpaceExW June 14, 2021, 1:34 p.m.	total_number_of_free_bytes: 0 free_bytes_available: 13297270784 root_path: C:\Users\test22\AppData\Local\Microsoft\Windows\Explorer total_number_of_bytes: 0	1	1	0

Creates a shortcut to an executable file (13 events)

file	C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Accessories\Snipping Tool.lnk
file	C:\ProgramData\Microsoft\Windows\Start Menu\Programs\EditPlus.lnk
file	C:\Users\test22\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\User Pinned\TaskBar\Windows Explorer.lnk
file	C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Accessories\Welcome Center.lnk
file	C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Windows Fax and Scan.lnk
file	C:\Users\test22\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\User Pinned\TaskBar\Chrome.lnk
file	C:\ProgramData\Microsoft\Windows\Start Menu\Programs\7-Zip\7-Zip File Manager.lnk
file	C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Accessories\Calculator.lnk
file	C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Accessories\Paint.lnk
file	C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Accessories\displayswitch.lnk
file	C:\Users\test22\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\User Pinned\TaskBar\Internet Explorer.lnk
file	C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Accessories\Sticky Notes.lnk
file	C:\ProgramData\Microsoft\Windows\Start Menu\Programs\XPS Viewer.lnk

Checks for the Locally Unique Identifier on the system for a suspicious privilege (8 events)

Time & API	Arguments	Status	Return
LookupPrivilegeValueW June 14, 2021, 1:34 p.m.	system_name: privilege_name: SeShutdownPrivilege	1	1
LookupPrivilegeValueW June 14, 2021, 1:34 p.m.	system_name: privilege_name: SeShutdownPrivilege	1	1
LookupPrivilegeValueW June 14, 2021, 1:34 p.m.	system_name: privilege_name: SeShutdownPrivilege	1	1
LookupPrivilegeValueW June 14, 2021, 1:34 p.m.	system_name: privilege_name: SeShutdownPrivilege	1	1
LookupPrivilegeValueW June 14, 2021, 1:34 p.m.	system_name: privilege_name: SeShutdownPrivilege	1	1
LookupPrivilegeValueW June 14, 2021, 1:34 p.m.	system_name: privilege_name: SeShutdownPrivilege	1	1
LookupPrivilegeValueW June 14, 2021, 1:34 p.m.	system_name: privilege_name: SeShutdownPrivilege	1	1
LookupPrivilegeValueW June 14, 2021, 1:34 p.m.	system_name: privilege_name: SeShutdownPrivilege	1	1

Yara rule detected in process memory (8 events)

description	(no description)	rule	DebuggerCheck__GlobalFlags
description	(no description)	rule	DebuggerCheck__QueryInfo
description	(no description)	rule	DebuggerHiding__Thread
description	(no description)	rule	DebuggerHiding__Active
description	(no description)	rule	ThreadControl__Context
description	(no description)	rule	SEH__vectored
description	Checks if being debugged	rule	anti_dbg
description	Bypass DEP	rule	disable_dep

Communicates with host for which no DNS query was performed (2 events)

host	172.217.25.14
host	51.15.78.68

Attempts to modify browser security settings (1 event)

registry

HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_BROWSER_EMULATION\EDITPLUS.EXE

Harvests credentials from local email clients (1 event)

registry

HKEY_LOCAL_MACHINE\SOFTWARE\Clients\Mail\Mozilla Thunderbird\Capabilities\Hidden

File has been identified by 23 AntiVirus engines on VirusTotal as malicious (23 events)

MicroWorld-eScan	Trojan.GenericKD.46477619
FireEye	Trojan.GenericKD.46477619
ALYac	Trojan.GenericKD.46477619
Sangfor	Malware.ELF-Script.Save.3be8a403
ESET-NOD32	a variant of Linux/Mirai.BGU
TrendMicro-HouseCall	Backdoor.Linux.ZYX.USELVFD21
Avast	ELF:Mirai-BHF [Trj]
ClamAV	Unix.Trojan.Mirai-7138377-0
BitDefender	Trojan.GenericKD.46477619
Ad-Aware	Trojan.GenericKD.46477619
Comodo	.UnclassifiedMalware@0
TrendMicro	Backdoor.Linux.ZYX.USELVFD21
Emsisoft	Trojan.GenericKD.46477619 (B)
Avast-Mobile	ELF:Mirai-BHG [Trj]
Avira	LINUX/Mirai.nbvfw
MAX	malware (ai score=83)
Microsoft	Trojan:Script/Wacatac.B!ml
GData	Linux.Trojan.Agent.HGU1C2
Cynet	Malicious (score: 99)
Ikarus	Trojan.Linux.Mirai
Fortinet	Linux/Mirai.BGU!tr
BitDefenderTheta	Gen:NN.Mirai.34738
AVG	ELF:Mirai-BHF [Trj]

bot.superh

Process Tree Toggle all

Network Toggle all

Suricata Toggle all

Suricata Alerts

Suricata TLS

Signatures Toggle All