Summary | ZeroBOX

Category	Machine	Started	Completed
FILE	s1_win7_x6402	June 24, 2021, 7:05 p.m.	June 24, 2021, 7:22 p.m.

Size	278.0KB
Type	PE32 executable (GUI) Intel 80386 (stripped to external PDB), for MS Windows
MD5	`088bd377384bc07c458f3b6bd5d54dbd`
SHA256	`0b88dd821cf352dd46cd57c0a5cc4542fead6bf4afe82ff1a52939be744df0ad`
CRC32	`CF1D7400`
ssdeep	`6144:rRAryvMNgpJjTwIh0DlyuhjezGIQ/Yl+x:r+ZNgnzh+lyuhjeqVf`
Yara	PE_Header_Zero - PE File Signature IsPE32 - (no description) Malicious_Library_Zero - Malicious_Library

stagelessexe.exe "C:\Users\test22\AppData\Local\Temp\stagelessexe.exe"
8212

Name	Response	Post-Analysis Lookup
sharkfishinguk.com	A 3.95.159.27	3.95.159.27

IP Address	Status	Action
164.124.101.2	Active	Moloch
172.217.25.14	Active	Moloch
3.95.159.27	Active	Moloch

Suricata Alerts

No Suricata Alerts

Suricata TLS

No Suricata TLS

Queries for the computername (1 event)

Time & API	Arguments	Status	Return	Repeated
GetComputerNameA June 24, 2021, 7:05 p.m.	computer_name: TEST22-PC	1	1	0

A process attempted to delay the analysis task. (1 event)

description

stagelessexe.exe tried to sleep 210 seconds, actually delayed analysis time by 210 seconds

Changes read-write memory protection to read-execute (probably to avoid detection when setting all RWX flags at the same time) (1 event)

Time & API	Arguments	Status	Return	Repeated
NtProtectVirtualMemory June 24, 2021, 7:05 p.m.	process_identifier: 8212 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 length: 208896 protection: 32 (PAGE_EXECUTE_READ) base_address: 0x00650000 process_handle: 0xffffffff	1	0	0

Communicates with host for which no DNS query was performed (1 event)

host

172.217.25.14

File has been identified by 58 AntiVirus engines on VirusTotal as malicious (50 out of 58 events)

Bkav	W32.AIDetect.malware1
Elastic	malicious (high confidence)
DrWeb	BackDoor.Siggen2.247
MicroWorld-eScan	Gen:Variant.Fugrafa.858
FireEye	Generic.mg.088bd377384bc07c
CAT-QuickHeal	Trojan.Cobaltstrike
McAfee	GenericRXMO-OO!088BD377384B
Cylance	Unsafe
Sangfor	Trojan.Win32.Save.a
K7AntiVirus	Trojan ( 005624dc1 )
Alibaba	Trojan:Win32/Rozena.874b7578
K7GW	Trojan ( 005624dc1 )
Cybereason	malicious.7384bc
BitDefenderTheta	AI:Packer.8E815CBA1E
Cyren	W32/Diple.F.gen!Eldorado
Symantec	Backdoor.Cobalt
ESET-NOD32	a variant of Win32/Rozena.AMZ
APEX	Malicious
Paloalto	generic.ml
ClamAV	Win.Trojan.CobaltStrike-7899872-1
Kaspersky	HEUR:Trojan.Win32.CobaltStrike.gen
BitDefender	Gen:Variant.Fugrafa.858
NANO-Antivirus	Trojan.Win32.Rozena.hpcmlv
Avast	Win32:HacktoolX-gen [Trj]
Tencent	Malware.Win32.Gencirc.10ce3cbf
Ad-Aware	Gen:Variant.Fugrafa.858
TACHYON	Trojan/W32.Agent.284672.IN
Emsisoft	Gen:Variant.Fugrafa.858 (B)
VIPRE	Trojan.Win32.Generic!BT
TrendMicro	Trojan.Win32.COBALT.SM
McAfee-GW-Edition	BehavesLike.Win32.Swisyn.dh
Sophos	Mal/Generic-R + ATK/Cobalt-A
Ikarus	Trojan.Win32.Rozena
Jiangmin	Trojan.Cometer.aww
Avira	TR/Crypt.XPACK.Gen7
Antiy-AVL	Trojan/Generic.ASMalwS.30CAC8E
Microsoft	Trojan:Win32/Cobaltstrike.MK!MTB
Gridinsoft	Trojan.Win32.Gen.oa!s1
ViRobot	Trojan.Win32.Cobalt.284672.A
ZoneAlarm	HEUR:Trojan.Win32.CobaltStrike.gen
GData	Gen:Variant.Fugrafa.858
Cynet	Malicious (score: 100)
AhnLab-V3	Trojan/Win32.CobaltStrike.R329694
Acronis	suspicious
VBA32	Trojan.CobaltStrike
ALYac	Gen:Variant.Fugrafa.858
MAX	malware (ai score=100)
Malwarebytes	Backdoor.Rozena
TrendMicro-HouseCall	Trojan.Win32.COBALT.SM
Rising	Backdoor.CobaltStrike!1.D049 (CLASSIC)

Connects to IP addresses that are no longer responding to requests (legitimate services will remain up-and-running usually) (7 events)

dead_host	192.168.56.102:49812
dead_host	192.168.56.102:49806
dead_host	192.168.56.102:49813
dead_host	192.168.56.102:49810
dead_host	192.168.56.102:49811
dead_host	192.168.56.102:49809
dead_host	3.95.159.27:443

stagelessexe.exe

Process Tree Toggle all

Network Toggle all

Suricata Toggle all

Suricata Alerts

Suricata TLS

Signatures Toggle All