Summary | ZeroBOX

Category	Machine	Started	Completed
FILE	s1_win7_x6402	June 15, 2021, 10:53 a.m.	June 15, 2021, 10:55 a.m.

Size	310.5KB
Type	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
MD5	`d6a73306c5bdcc557880a455bfb1a4be`
SHA256	`427fb58726e2c9632bf9dedb78bc6492d96e2126280aace443d8b7ccd1c93297`
CRC32	`FB6F2CC6`
ssdeep	`6144:c8vnsAwWmn/dO1yW5I9dN+lC3IJO1GN9hJ9xbtuZfleHlO7OSCiPenDu+YFUPuGm:c8/sAwWGdelk+ahGD3btyolO6SCQeDz4`
Yara	Win_Backdoor_AsyncRAT_Zero - Win Backdoor AsyncRAT Win32_Trojan_PWS_Net_1_Zero - Win32 Trojan PWS .NET Azorult PE_Header_Zero - PE File Signature Is_DotNET_EXE - (no description) IsPE32 - (no description) Win_Backdoor_njRAT_1_Zero - Win Backdoor njRAT

UltraMediaBurner.exe "C:\Users\test22\AppData\Local\Temp\UltraMediaBurner.exe"
6240

Name	Response	Post-Analysis Lookup
No hosts contacted.

IP Address	Status	Action
172.217.25.14	Active	Moloch

Suricata Alerts

No Suricata Alerts

Suricata TLS

No Suricata TLS

Checks if process is being debugged by a debugger (2 events)

Time & API	Arguments	Status	Return	Repeated
IsDebuggerPresent June 15, 2021, 10:53 a.m.			0	0
IsDebuggerPresent June 15, 2021, 10:53 a.m.			0	0

Collects information to fingerprint the system (MachineGuid, DigitalProductId, SystemBiosDate) (1 event)

registry

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\MachineGuid

Checks amount of memory in system, this can be used to detect virtual machines that have a low amount of memory available (1 event)

Time & API	Arguments	Status	Return	Repeated
GlobalMemoryStatusEx June 15, 2021, 10:53 a.m.		1	1	0

Allocates read-write-execute memory (usually to unpack itself) (40 events)

Time & API	Arguments	Status
NtAllocateVirtualMemory June 15, 2021, 10:53 a.m.	process_identifier: 6240 region_size: 786432 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0000000000650000 allocation_type: 8192 (MEM_RESERVE) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory June 15, 2021, 10:53 a.m.	process_identifier: 6240 region_size: 8192 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0000000000690000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory June 15, 2021, 10:53 a.m.	process_identifier: 6240 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fef2361000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory June 15, 2021, 10:53 a.m.	process_identifier: 6240 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fef29fb000 process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory June 15, 2021, 10:53 a.m.	process_identifier: 6240 region_size: 1114112 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0000000002040000 allocation_type: 8192 (MEM_RESERVE) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory June 15, 2021, 10:53 a.m.	process_identifier: 6240 region_size: 8192 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00000000020d0000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory June 15, 2021, 10:53 a.m.	process_identifier: 6240 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fef2362000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory June 15, 2021, 10:53 a.m.	process_identifier: 6240 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fef2362000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory June 15, 2021, 10:53 a.m.	process_identifier: 6240 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fef2362000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory June 15, 2021, 10:53 a.m.	process_identifier: 6240 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fef2362000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory June 15, 2021, 10:53 a.m.	process_identifier: 6240 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fef2362000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory June 15, 2021, 10:53 a.m.	process_identifier: 6240 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fef2362000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory June 15, 2021, 10:53 a.m.	process_identifier: 6240 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fef2362000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory June 15, 2021, 10:53 a.m.	process_identifier: 6240 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fef2362000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory June 15, 2021, 10:53 a.m.	process_identifier: 6240 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fef2362000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory June 15, 2021, 10:53 a.m.	process_identifier: 6240 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fef2362000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory June 15, 2021, 10:53 a.m.	process_identifier: 6240 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fef2362000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory June 15, 2021, 10:53 a.m.	process_identifier: 6240 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fef2364000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory June 15, 2021, 10:53 a.m.	process_identifier: 6240 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fef2364000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory June 15, 2021, 10:53 a.m.	process_identifier: 6240 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fef2364000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory June 15, 2021, 10:53 a.m.	process_identifier: 6240 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fef2364000 process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory June 15, 2021, 10:53 a.m.	process_identifier: 6240 region_size: 655360 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fffff10000 allocation_type: 1056768 (MEM_RESERVE\|MEM_TOP_DOWN) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory June 15, 2021, 10:53 a.m.	process_identifier: 6240 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fffff10000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory June 15, 2021, 10:53 a.m.	process_identifier: 6240 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fffff10000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory June 15, 2021, 10:53 a.m.	process_identifier: 6240 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fffff20000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory June 15, 2021, 10:53 a.m.	process_identifier: 6240 region_size: 65536 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fffff00000 allocation_type: 1056768 (MEM_RESERVE\|MEM_TOP_DOWN) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory June 15, 2021, 10:53 a.m.	process_identifier: 6240 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fffff00000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory June 15, 2021, 10:53 a.m.	process_identifier: 6240 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fe92bba000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory June 15, 2021, 10:53 a.m.	process_identifier: 6240 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fe92bcc000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory June 15, 2021, 10:53 a.m.	process_identifier: 6240 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fe92ce0000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory June 15, 2021, 10:53 a.m.	process_identifier: 6240 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fe92ce1000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory June 15, 2021, 10:53 a.m.	process_identifier: 6240 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fe92bdb000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory June 15, 2021, 10:53 a.m.	process_identifier: 6240 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fe92c6c000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory June 15, 2021, 10:53 a.m.	process_identifier: 6240 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fe92c96000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory June 15, 2021, 10:53 a.m.	process_identifier: 6240 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fe92c70000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory June 15, 2021, 10:53 a.m.	process_identifier: 6240 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fe92bbb000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory June 15, 2021, 10:53 a.m.	process_identifier: 6240 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fe92c0c000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory June 15, 2021, 10:53 a.m.	process_identifier: 6240 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fe92bdd000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory June 15, 2021, 10:53 a.m.	process_identifier: 6240 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fe92bb2000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory June 15, 2021, 10:53 a.m.	process_identifier: 6240 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fe92ce2000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1

The binary likely contains encrypted or compressed data indicative of a packer (2 events)

section

{u'size_of_data': u'0x00035600', u'virtual_address': u'0x0001a000', u'entropy': 7.920456836220288, u'name': u'.rsrc', u'virtual_size': u'0x00035540'}

entropy

7.92045683622

description

A section with a high entropy has been found

entropy

0.688709677419

description

Overall entropy of this PE file is high

Communicates with host for which no DNS query was performed (1 event)

host

172.217.25.14

File has been identified by 37 AntiVirus engines on VirusTotal as malicious (37 events)

MicroWorld-eScan	Trojan.GenericKDZ.75496
FireEye	Generic.mg.d6a73306c5bdcc55
CAT-QuickHeal	PUA.WacapewFC.S19435813
ALYac	Trojan.GenericKDZ.75496
Cylance	Unsafe
Alibaba	AdWare:MSIL/CsdiMonetize.a6471fa4
CrowdStrike	win/malicious_confidence_60% (W)
BitDefenderTheta	Gen:NN.ZemsilF.34738.tm0@aKsiNJh
Cyren	W32/Trojan.UPXP-2006
Symantec	ML.Attribute.HighConfidence
ESET-NOD32	a variant of MSIL/Adware.CsdiMonetize.BC
APEX	Malicious
Avast	Win32:MiscX-gen [PUP]
Kaspersky	not-a-virus:HEUR:AdWare.MSIL.Csdi.gen
BitDefender	Trojan.GenericKDZ.75496
Ad-Aware	Trojan.GenericKDZ.75496
Emsisoft	Trojan.GenericKDZ.75496 (B)
TrendMicro	TROJ_GEN.R002C0PFE21
McAfee-GW-Edition	PUP-XOH-OC
Sophos	Mal/Generic-S
SentinelOne	Static AI - Malicious PE
Webroot	W32.Malware.Gen
Avira	TR/Dropper.Gen
MAX	malware (ai score=88)
Microsoft	Trojan:Win32/AgentTesla!ml
AegisLab	Adware.MSIL.Csdi.2!c
ZoneAlarm	not-a-virus:HEUR:AdWare.MSIL.Csdi.gen
GData	Trojan.GenericKDZ.75496
Cynet	Malicious (score: 100)
McAfee	PUP-XOH-OC
Malwarebytes	Adware.Csdimonetize
TrendMicro-HouseCall	TROJ_GEN.R002C0PFE21
Ikarus	PUA.Generic
Fortinet	Adware/CsdiMonetize
AVG	Win32:MiscX-gen [PUP]
Cybereason	malicious.8165cc
Panda	Trj/GdSda.A

UltraMediaBurner.exe

Process Tree Toggle all

Network Toggle all

Suricata Toggle all

Suricata Alerts

Suricata TLS

Signatures Toggle All