Summary | ZeroBOX

Category	Machine	Started	Completed
FILE	s1_win7_x6402	June 24, 2021, 7:30 p.m.	June 24, 2021, 8:16 p.m.

Size	11.0KB
Type	PE32 executable (console) Intel 80386 Mono/.Net assembly, for MS Windows
MD5	`94bbee3cdbcc598b4fc638b6ece1f35e`
SHA256	`16307514ad93c670e3cf60528e8007b817f56838feb91d4bea342dd88ded9567`
CRC32	`A5367EFE`
ssdeep	`192:OzEqNlaYBcPIOMxuB1EharnsB/PvvFxuuAx7ab:O4qC0cA1wnEarns9XvXuuk+`
PDB Path	C:\Users\mccor\source\repos\yireiotpertieroptiertoert\yireiotpertieroptiertoert\obj\Debug\yireiotpertieroptiertoert.pdb
Yara	Win_Backdoor_AsyncRAT_Zero - Win Backdoor AsyncRAT PE_Header_Zero - PE File Signature Is_DotNET_EXE - (no description) Generic_Malware_Zero - Generic Malware IsPE32 - (no description)

howdidyou.exe "C:\Users\test22\AppData\Local\Temp\howdidyou.exe"
4356

Name	Response	Post-Analysis Lookup
discord.com	A 162.159.137.232 A 162.159.138.232 A 162.159.128.233 A 162.159.135.232 A 162.159.136.232	162.159.136.232

IP Address	Status	Action
162.159.136.232	Active	Moloch
164.124.101.2	Active	Moloch
172.217.25.14	Active	Moloch

Suricata Alerts

Flow	SID	Signature	Category
TCP 192.168.56.102:49806 -> 162.159.136.232:443	906200056	SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee)	undefined

Suricata TLS

Flow	Issuer	Subject	Fingerprint
TLSv1 192.168.56.102:49806 162.159.136.232:443	C=US, O=Cloudflare, Inc., CN=Cloudflare Inc RSA CA-2	C=US, ST=CA, L=San Francisco, O=Cloudflare, Inc., CN=sni.cloudflaressl.com	af:ff:1b:9d:0f:f5:f2:ad:ef:c8:c3:f5:45:0f:7f:e8:20:a0:79:0a

Queries for the computername (3 events)

Time & API	Arguments	Status	Return
GetComputerNameW June 24, 2021, 7:30 p.m.	computer_name: TEST22-PC	1	1
GetComputerNameA June 24, 2021, 7:30 p.m.	computer_name: TEST22-PC	1	1
GetComputerNameW June 24, 2021, 7:30 p.m.	computer_name: TEST22-PC	1	1

Checks if process is being debugged by a debugger (4 events)

Time & API	Arguments	Status	Return	Repeated
IsDebuggerPresent June 24, 2021, 7:30 p.m.			0	0
IsDebuggerPresent June 24, 2021, 7:30 p.m.			0	0
IsDebuggerPresent June 24, 2021, 7:30 p.m.			0	0
IsDebuggerPresent June 24, 2021, 7:30 p.m.			0	0

Command line console output was observed (1 event)

Time & API	Arguments	Status	Return	Repeated
WriteConsoleA June 24, 2021, 7:30 p.m.	buffer: System.Net.WebException: ?? ???? (429) Too Many Requests ??? ??????. ??: System.Net.WebClient.UploadValues(Uri address, String method, NameValueCollection data) ??: System.Net.WebClient.UploadValues(String address, NameValueCollection data) ??: Microchip.Program.ApiRequests.Post(String uri, NameValueCollection pairs) ??: Microchip.Program.mcMods() ??: Microchip.Program.Main(String[] args) console_handle: 0x0000000b	1	1	0

This executable has a PDB path (1 event)

pdb_path

C:\Users\mccor\source\repos\yireiotpertieroptiertoert\yireiotpertieroptiertoert\obj\Debug\yireiotpertieroptiertoert.pdb

Checks amount of memory in system, this can be used to detect virtual machines that have a low amount of memory available (1 event)

Time & API	Arguments	Status	Return	Repeated
GlobalMemoryStatusEx June 24, 2021, 7:30 p.m.		1	1	0

HTTP traffic contains suspicious features which may be indicative of malware related traffic (1 event)

suspicious_features

POST method with no referer header, POST method with no useragent header

suspicious_request

POST https://discord.com/api/webhooks/855705156444094504/wI1ePCkz2YUM4Gk-hmnvocsg-XyNz-ww21jnKAq4w7yoaBPG_FvuwcJx8DAT7mXsf-Ha

Performs some HTTP requests (1 event)

request

POST https://discord.com/api/webhooks/855705156444094504/wI1ePCkz2YUM4Gk-hmnvocsg-XyNz-ww21jnKAq4w7yoaBPG_FvuwcJx8DAT7mXsf-Ha

Sends data using the HTTP POST Method (1 event)

request

POST https://discord.com/api/webhooks/855705156444094504/wI1ePCkz2YUM4Gk-hmnvocsg-XyNz-ww21jnKAq4w7yoaBPG_FvuwcJx8DAT7mXsf-Ha

Allocates read-write-execute memory (usually to unpack itself) (19 events)

Time & API	Arguments	Status
NtAllocateVirtualMemory June 24, 2021, 7:30 p.m.	process_identifier: 4356 region_size: 720896 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00630000 allocation_type: 8192 (MEM_RESERVE) process_handle: 0xffffffff	1
NtAllocateVirtualMemory June 24, 2021, 7:30 p.m.	process_identifier: 4356 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x006a0000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtProtectVirtualMemory June 24, 2021, 7:30 p.m.	process_identifier: 4356 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x6fba1000 process_handle: 0xffffffff	1
NtProtectVirtualMemory June 24, 2021, 7:30 p.m.	process_identifier: 4356 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x6fba2000 process_handle: 0xffffffff	1
NtAllocateVirtualMemory June 24, 2021, 7:30 p.m.	process_identifier: 4356 region_size: 655360 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x006e0000 allocation_type: 8192 (MEM_RESERVE) process_handle: 0xffffffff	1
NtAllocateVirtualMemory June 24, 2021, 7:30 p.m.	process_identifier: 4356 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00740000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory June 24, 2021, 7:30 p.m.	process_identifier: 4356 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00522000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory June 24, 2021, 7:30 p.m.	process_identifier: 4356 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00555000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory June 24, 2021, 7:30 p.m.	process_identifier: 4356 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0055b000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory June 24, 2021, 7:30 p.m.	process_identifier: 4356 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00557000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory June 24, 2021, 7:30 p.m.	process_identifier: 4356 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0053c000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory June 24, 2021, 7:30 p.m.	process_identifier: 4356 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00730000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory June 24, 2021, 7:30 p.m.	process_identifier: 4356 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00546000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory June 24, 2021, 7:30 p.m.	process_identifier: 4356 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0053a000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory June 24, 2021, 7:30 p.m.	process_identifier: 4356 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0052a000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtProtectVirtualMemory June 24, 2021, 7:30 p.m.	process_identifier: 4356 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x73772000 process_handle: 0xffffffff	1
NtAllocateVirtualMemory June 24, 2021, 7:30 p.m.	process_identifier: 4356 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0054a000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory June 24, 2021, 7:30 p.m.	process_identifier: 4356 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00547000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory June 24, 2021, 7:30 p.m.	process_identifier: 4356 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0054b000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1

Checks adapter addresses which can be used to detect virtual network interfaces (1 event)

Time & API	Arguments	Status	Return	Repeated
GetAdaptersAddresses June 24, 2021, 7:30 p.m.	flags: 15 family: 0		111	0

Communicates with host for which no DNS query was performed (1 event)

host

172.217.25.14

File has been identified by 37 AntiVirus engines on VirusTotal as malicious (37 events)

Elastic	malicious (high confidence)
MicroWorld-eScan	Trojan.GenericKD.37131879
FireEye	Generic.mg.94bbee3cdbcc598b
ALYac	Gen:Variant.Bulz.525216
Sangfor	Trojan.Win32.Save.a
K7AntiVirus	Password-Stealer ( 0057ccd41 )
Alibaba	Trojan:MSIL/Generic.6cbc9cc0
K7GW	Password-Stealer ( 0057ccd41 )
Symantec	Trojan.Gen.MBT
ESET-NOD32	a variant of MSIL/PSW.Discord.WG
APEX	Malicious
Avast	Win32:PWSX-gen [Trj]
Kaspersky	HEUR:Trojan-PSW.MSIL.Disco.gen
BitDefender	Trojan.GenericKD.37131879
AegisLab	Trojan.Win32.Disco.i!c
Tencent	Trojan.Win32.Polyransom.b
Ad-Aware	Gen:Variant.Bulz.525216
Emsisoft	Gen:Variant.Bulz.525216 (B)
DrWeb	Trojan.PWS.DiscordNET.14
McAfee-GW-Edition	Artemis!Trojan
Sophos	Mal/Generic-S
SentinelOne	Static AI - Suspicious PE
Avira	HEUR/AGEN.1110045
Microsoft	Trojan:Win32/Wacatac.B!ml
Gridinsoft	Ransom.Win32.Gen.sa
GData	Trojan.GenericKD.37131879
Cynet	Malicious (score: 99)
McAfee	RDN/Generic PWS.y
MAX	malware (ai score=86)
Malwarebytes	Spyware.DiscordStealer.Generic
TrendMicro-HouseCall	TROJ_GEN.R002H0DFL21
Ikarus	Trojan.MSIL.PSW
Fortinet	MSIL/Discord.WG!tr.pws
AVG	Win32:PWSX-gen [Trj]
Panda	Trj/GdSda.A
CrowdStrike	win/malicious_confidence_100% (W)
MaxSecure	Trojan.Malware.300983.susgen

howdidyou.exe

Process Tree Toggle all

Network Toggle all

Suricata Toggle all

Suricata Alerts

Suricata TLS

Signatures Toggle All