popup
Summary | ZeroBOX
  1. Home
  2. Result
  3. Report
  4. Detail Analysis

2022c578cf7429b85615d4819d161edc.exe

OS Processor Check GIF Format PE32 PE File DLL
  1. Resubmit sample
Category Machine Started Completed
FILE s1_win7_x6402 June 25, 2021, 9:30 a.m. June 25, 2021, 9:33 a.m.
Size 680.0KB
Type PE32 executable (console) Intel 80386, for MS Windows
MD5 41c69a7f93fbe7edc44fd1b09795fa67
SHA256 8b720f6963165f9aca1600e2e3efb04a7162014d0d738fb7f8b9872019f49bd5
CRC32 898421AF
ssdeep 12288:Umn1vBXNJl0P3ZbcCAjqH0d5i+qUH6wyZQMvvdgMiCiT:n1vJNJla39cGH0dg7sOlQCiT
Yara
  • PE_Header_Zero - PE File Signature
  • OS_Processor_Check_Zero - OS Processor Check
  • Win32_Trojan_Gen_2_0904B0_Zero - Win32 Trojan Gen
  • IsPE32 - (no description)

Name Response Post-Analysis Lookup
email.yg9.me 198.13.62.186
email.yg9.me
A 198.13.62.186
198.13.62.186
ol.gamegame.info
A 172.67.200.215
A 104.21.21.221
172.67.200.215
ip-api.com
A 208.95.112.1
208.95.112.1
iw.gamegame.info
A 172.67.200.215
A 104.21.21.221
172.67.200.215
IP Address Status Action
164.124.101.2 Active Moloch
172.217.25.14 Active Moloch
172.67.200.215 Active Moloch
198.13.62.186 Active Moloch
208.95.112.1 Active Moloch

Suricata Alerts

Flow SID Signature Category
UDP 192.168.56.102:50840 -> 198.13.62.186:53 2014702 ET DNS Non-DNS or Non-Compliant DNS traffic on DNS port Opcode 8 through 15 set Potential Corporate Privacy Violation
TCP 192.168.56.102:49812 -> 208.95.112.1:80 2022082 ET POLICY External IP Lookup ip-api.com Device Retrieving External IP Address Detected
TCP 192.168.56.102:49812 -> 208.95.112.1:80 2022082 ET POLICY External IP Lookup ip-api.com Device Retrieving External IP Address Detected
TCP 192.168.56.102:49812 -> 208.95.112.1:80 2022082 ET POLICY External IP Lookup ip-api.com Device Retrieving External IP Address Detected
TCP 192.168.56.102:49812 -> 208.95.112.1:80 2022082 ET POLICY External IP Lookup ip-api.com Device Retrieving External IP Address Detected
TCP 192.168.56.102:49812 -> 208.95.112.1:80 2022082 ET POLICY External IP Lookup ip-api.com Device Retrieving External IP Address Detected

Suricata TLS

No Suricata TLS

Time & API Arguments Status Return Repeated

IsDebuggerPresent

 0 0
registry HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\MachineGuid
Time & API Arguments Status Return Repeated

GlobalMemoryStatusEx

 1 1 0
section .gfids
suspicious_features POST method with no referer header suspicious_request POST http://iw.gamegame.info/report7.4.php
suspicious_features POST method with no referer header suspicious_request POST http://ol.gamegame.info/report7.4.php
request GET http://ip-api.com/json/?fields=8198
request POST http://iw.gamegame.info/report7.4.php
request POST http://ol.gamegame.info/report7.4.php
request POST http://iw.gamegame.info/report7.4.php
request POST http://ol.gamegame.info/report7.4.php
Time & API Arguments Status Return Repeated

NtProtectVirtualMemory

 process_identifier: 8800
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x10006000
process_handle: 0xffffffff
1 0 0

NtProtectVirtualMemory

 process_identifier: 8800
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x73e80000
process_handle: 0xffffffff
1 0 0

NtProtectVirtualMemory

 process_identifier: 8800
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x73771000
process_handle: 0xffffffff
1 0 0

NtProtectVirtualMemory

 process_identifier: 8800
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x73861000
process_handle: 0xffffffff
1 0 0

NtProtectVirtualMemory

 process_identifier: 8800
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x72da4000
process_handle: 0xffffffff
1 0 0

NtProtectVirtualMemory

 process_identifier: 8800
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x73772000
process_handle: 0xffffffff
1 0 0

NtProtectVirtualMemory

 process_identifier: 8800
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x73e01000
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 8800
region_size: 1638400
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x022b0000
allocation_type: 8192 (MEM_RESERVE)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 8800
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x02400000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 8800
region_size: 1052672
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x02160000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 8800
region_size: 380928
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x02090000
allocation_type: 12288 (MEM_COMMIT|MEM_RESERVE)
process_handle: 0xffffffff
1 0 0

NtProtectVirtualMemory

 process_identifier: 8800
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x71f81000
process_handle: 0xffffffff
1 0 0

NtProtectVirtualMemory

 process_identifier: 8800
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x76891000
process_handle: 0xffffffff
1 0 0

NtProtectVirtualMemory

 process_identifier: 8800
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x740f1000
process_handle: 0xffffffff
1 0 0

NtProtectVirtualMemory

 process_identifier: 8800
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x75111000
process_handle: 0xffffffff
1 0 0

NtProtectVirtualMemory

 process_identifier: 8800
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x75241000
process_handle: 0xffffffff
1 0 0

NtProtectVirtualMemory

 process_identifier: 8800
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x74f41000
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 8800
region_size: 311296
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x01ef0000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0
domain ip-api.com
file C:\Users\test22\AppData\Local\Temp\axhub.dll.lnk
file C:\Users\test22\AppData\Local\Temp\axhub.dll
file C:\Users\test22\AppData\Local\Temp\axhub.dll.lnk
file C:\Users\test22\AppData\Local\Temp\axhub.dll.lnk
file C:\Users\test22\AppData\Local\Temp\axhub.dll
Time & API Arguments Status Return Repeated

Process32NextW

 snapshot_handle: 0x00000120
process_name: mobsync.exe
process_identifier: 1420
1 1 0

Process32NextW

 snapshot_handle: 0x00000120
process_name: pw.exe
process_identifier: 8188
1 1 0

Process32NextW

 snapshot_handle: 0x00000120
process_name: cmd.exe
process_identifier: 1836
1 1 0

Process32NextW

 snapshot_handle: 0x00000120
process_name: rundll32.exe
process_identifier: 8800
1 1 0
process rundll32.exe
host 172.217.25.14
Time & API Arguments Status Return Repeated

RegSetValueExW

 key_handle: 0x00000124
regkey_r: 1
reg_type: 3 (REG_BINARY)
value: ÁÕx4XÁåH<PÁýPwËoÜØ_µHŀµ¾HŘ¼«HcáA—@ű4^¯fZÅÊC@K°h·?ˆËjètM=…ã•ŸK£¹áü÷¶­Ãc~–¹²$ ?xÃ{a‰LÇs°Íh™$ÏüsEø½ƒç@tPAÊ]—ù¸003ú6)žÃ{¸ÍE´H±Æ·¹ÎMŽÅÉ`tÃ]žÁÍ` dÁÂGÅh™»ÿ*^ßptÃE&÷3á“ù¸€€HÃE¾(ŸÃ×x|ÃçHD(ÃÿPL ËGôqœ‹Ã ç„ÁÕx<‘Åh,]ÅáHñÉm,Àe-Ï!E`3è‚â‰.DDH‚îçLLLHÃÛHTÇÙB]ÆÉr}ÈEϋû~I*#|·@ŠNRƙPÉ7¼ˆˆBÉ„ŒŒ‰Ì*œüp:ò2z‹½ÃÎòÿ‰)øTK¸ÀL½ThÃÞêúÎRÖ±¼Ãčº[€B!ãˀ·=‹Êhêt’ªÀ4³pºÊúQiJó±x`AnóÁϕ•XžNېÅûrEN±½J¶< Çӑyc¤Š›c‰1~"yò8†zBaj ;»­¾ÊÊe©3vJÃϸ£@ÊÂUUJËCŸ…ØJәrêލ7µ‹Î*&J‰së߈!¦Aø—.‹@|2~o‘ˆNÇH<>α~¦$ËÍ‚ƒÏJKŽP{û´Ÿ®ÉÌ@Šp·OÁƒN±¾I¶?Âû¹y`§Š›eXXJ>==>§"ÍÅ ‚ƒK¸ûòÁ#ÀL¼e‰IOfïÕŠBE´kWÅÀŠL[ß±¿À ƍ¹X€@#ãې·>‰Ëiët’^õ;¡Ñ隣·ÅÀŠ8/]÷©¿ìOÃI)é1óˆÃ¸ÔðHÉEÀ_ž„ËoÄÀûí·ËkáAËGìë„ÁÕx,]ËoÜxÃrrQcõ;Q!ïFáü÷¶­ÁÍ` À6#F²$ ?xÃc9,F;—ÂÁ  ¬ˆLÇkTAFð¾õz4ÇsGRF–ŒR¹Á  ¤€èu`·ÁÍ`lÇckx»3t4ó)¼V¸õZf_>s~²½ f_>r­+Ktņ Hs⫧T½nEt}ˆ½<u¶{¸ fãÁz(bÃA²z(vÄHðf_}z*aÑàK¸óz8JÁ¹ úBZ•ÉÜPLÈE´VkÄ–‹ÊE:ø̈þ†¶JњËBéar묛ÔúÏÇr}~ñōߢ»Ïßjjgᓾ5FҐÊIƒ¶µoù´'zó»OqÀŽAʀJxrCIÊÈGENH C;áÑŒÀÖsiÌĶüËCJ€¶ÚáŽêNL‰ŽÏZ˜Êkét¾ojn_Š¾øù@Aù¸00AÊYáú6*ÃSÍEϋ_%»ÏÏzjÃ\ŸÃC‰¾(’vúˆN¸^"wr8u: Èäh¸rÅŒÁÊJÚ…E´VgÎJÖEÀE´aTÊZÒHŁKKԖ¾(’vú¯'Bî‹]WR8t²ŒÇçH˜õZf_:wweïŠK+G„èEHKøÂ>sv‹ŽŒ 7°…Eϋ ŽD}¶;´‰HřOÇP—gto»NÏÉFEB˼*ý½AÊKˆËkà@™9¤/³UE¾EwÁÇBMJ¸¶¸¹ððAN¸w¦Eâx¹  f]ú´dšKÀaðJljOMHÊBÃOfÿ¡¹‰vúBÉFLKÓ[NÏÉFEB˽ÖïÇ/€¬ˆ‹ …EϋšHŹ7ˆƒEϋŒ‹ÅBHÏå~XKȏÏ{¼Oè§Oð «p mvú…Çk¨ÍEϋü…¾Êb¤t7z3ÂE‹Îr±ÃšXÂG„ÍW«| ¸e9ìOËAÀJKÐ,k°¤€EvúÍEϋĽ´Â+g·:‰Çv´ˆ&äHƁ;{u0|Ê÷ËEҟƒEµôÍÇ/€¬ˆLÇçHdÏ ' EÀE´S¬ #¤…E´i–C€ð⿫ǁOÇH‹‰+éB¾*ÁÖouvóKôW`Ã@ƒKøºÌýqŠ])(REµhXvóóášÃ@4(äá“ù¸€€HÃ@Š¾+=OZtMŽÃ×xT8ËGôqž³Ð«XÄÂ’+qÍ 66 !6ÛI×p‚ñâÖc±È¬åÜ©ð"+  ŽŠ¤ìJ Ó}%ƒËN‚‰ „  ÊD†š•LZ`` ‚Ž  @Aõöà!@‚“–”ÙO øô PÞÖ]81‡‰•›UH€©¤øó™“ô/îççÿúõ´Œ)DdƎPŽ–'çÔŠXÁ“™J@€€ JN¥æŽÁAFz@úÁ+êÁ„… ÉÇÀúøú:ÁÊoªÇÏÕÉÝ ì džÜïeÞˌÕ[ÒåÓcÞȓRÀ¬…iû{¶xÇK‡âØþ~opaXŀ4µˆ@©%CÌÌHHƒoÄÀ˜ÿ3úŒvóóášɄô„{ÀÀúëÑÀèÞ~Ӏ;aFNÁŒÚþ"€GÌ Ág*£Ëÿó‰©â5h~'=øÀÔ֋bhâá,Ìà3Åö"4öà!áÃ#ãÀf¾äÀà èóûCu80xÅáHhà # /"öÁ ÅE‹ œÀ1QHc˨ÅÙp0›‰»»b$»ê':’ž €ÃhŒDÀÜNŒHÃÆMH{þ%lÈÆêaŒèuMYP¢àÍèÑôÙK{é¨"céî™z興ãŸxepòm™ôg‘è¡Éé‚hê èã‡`çºPÚó…ç™h½å3ááú6ê~þ„ÑԝŒILJÍE” dPbpJB‰ú”¯¹¼E@€@(• tÌ­iÈÃ'¥ì y‰ zö<<H@ÄELwvÁÕx$@ÁåH4XÁ‰tP<PÁõX$Ev((hň:»¹8-ô‘Áˆ“…J±êôu=èŽ á²Þ­b1ÞÍç„KàëPÙÊCHÅö#ÁâiR0`8µøwd+@Ÿ9öØ+(Xàwhõ%ÐáIh©ÎÿPE ¡IÁ%!æÍ+Ë {±!E'}bw@Ëmïõ´‰ÃçHX4T‹ÿPdÃ÷XhÁ € Š @Á‹H‹D ®!£ã!`ÇD2 âQ³ÅE†51ÇDáäæbB_ ! '_ÆÎÃ×x0) i!Ãv¶þ”QúhÃrČ¥ó5ã!uy·"¸!IÃÇ'Ò»“™LA€Y "‰æGiEH<šŠˆÆÿxßþ·RöÈ[I  IÃKé]P¼à~ë!ÃÂyÏ·]ÒQö[°Àk!Lb Ag¬~ú<$ŒSÏVù°àó<ÏóÕÄ÷«z3xH0ŠÀÃI5ê¡ìÜÄÿ:1º tNÊñyàgê<1ãø“~ç|“ü´±ä´t¨uü4106õö4:8.—Ä÷P¯e¥Çd¯„µËyàқcÂO‡ Ù²ƒsb‡¥òђ–éìt¼Y—7p¿ê ßȘH·«A†“PB+y]\AðçI·ÚÞj•KÍÏ mÞäQj¨9®Ma«{¸ÃaZ£fll"ŠÆDµe»¯ŠgXÌzsöt8ÇÈK›4!PutÃ^™Lc£ˆÃLJëÈ ôµ 31RozSmxHÃ߇»—ê•€¨¥+hµG$ûÃŌV›÷v€ÀkGx²ŒUh)_!¾ˆÑ{‘ÜùµEµs– DߤHHD(ʼn@`DPt` dÁ‰1?/v`Á—~DÇDŸgokážIuGÝy”LÌã/h|Á ¶yîEŸ>™w³@08pµÂàâÂĤìê_ÿ´rf³µtRòÎB¼À!=^u[xtÌ Ò?gsP†ßG6_@öæ›Èû½°º‹½uÀ€ÌGÈI@ȊlpJRTØ[\ŸÄ¯È&nfNÅÖZÂôóŒ+4o|ɁJv°QCď§ê¹.ºd¯êÆ(+ÛH@¢“3ÁÇT@#/€ùûÌA¶,íáHKõã‚ás÷ç#ÁâO q³ÒሪÐzÁ‚BÛ~ôK­ù@Dk$Oh(Àãꄓ…¨¿â­vŒp~.S+ÈókH{ê¢#CgêêÇò ©ÔP6:È+º¡âzi‘Êôû´îççUÍùqe`Òò¦¬UgOíAfË+€Ž{$H؊ ¢)Kj‘ÞW8o}yZo$e@ËoÌ2˘‘ÙAÅÁhr/‚ûA´ô‘Eϋ€U|§»ýÃt71Fâ]ìD'-ýé;_À0ôïìÉ~³t-ÊC+‡ƒJ µ¬šá1Ɔ»?„pEƒ´6ÏêÈRëzføê#ìz LDÇï!AHþs÷¿ÔG” +³@K7ŒŒ€@L‹W•ÀâsQÀéSwÆñ³àŒ¾&¥Ÿ-ó‰Âz¸HÁ£è{¼ÇiªÃ‹é`Ž>8‹¡-EÍzð‹€AÈÊkkž/bQ¶¯ÀÒSMÄòkUÈõtŒA+ìBGù»±¦BÆPC†Ÿ™.9ËEu|Ç@ĸúM(mÎMŽÁÍ`¤¸qÂ_œÅ vô+Üñ0213°ôÕý“ªg"52œxòÑÎ…‹u`ZÁ—õáBx»@#„¼Õô•8x°ô,Ü®Vi4E8¨Ô6z(^NîJ¦¢Ú9òþ×>¸etERqÇgB°}ð U¨8!TÿÛÈiÀrM JJL7à‹ÉϹ“—ꟊP¨¦G ?pÁ1+€Ãšº¶uÿäÀƒê`îS<$ÇGÉìܶ+šºŒ À‡<U˜´6ó*ãÅÌem@X•L½yÏÜWÂZÍõãZF$=€JÁÅ|,[””…™Ð¯çÁ™ˆ‚(+êǘ• MÅí(¸¹A"'\ü¤T´Å²¸;‹(¼\l+ (€ã˜ò‰NÐp4K¶ó5J;ŠìháàEwߥÃJ…\$ˆFs L˓Љ»ðøµsþ‹î[2€zùuU$7ó+î´µÅú+ÖɍÑ3aŠØC8mv×Æ)O4x<s˜¢_ ,%l$bFD+ê…û³{IIƒK…%p?û[‹ø¼ÏIŠÅ™àãPiRs
regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{LJU50KX1-5I52-VT6Q-WSWM-U2Z9XL21ZV61}\1
1 0 0
Elastic malicious (high confidence)
DrWeb Trojan.Inject4.12781
MicroWorld-eScan Trojan.GenericKD.37141241
ALYac Trojan.GenericKD.37141241
Cylance Unsafe
Sangfor Trojan.Win32.Save.a
K7AntiVirus Riskware ( 0040eff71 )
Alibaba TrojanDropper:Win32/Zenlod.6fcba1f1
K7GW Riskware ( 0040eff71 )
Arcabit Trojan.Generic.D236BAF9
Cyren W32/Trojan.OAML-5751
Symantec ML.Attribute.HighConfidence
ESET-NOD32 a variant of Win32/TrojanDropper.Agent.SNN
APEX Malicious
Paloalto generic.ml
Kaspersky HEUR:Trojan-Downloader.Win32.Zenlod.gen
BitDefender Trojan.GenericKD.37141241
Avast Win32:DropperX-gen [Drp]
Ad-Aware Trojan.GenericKD.37141241
Sophos Generic ML PUA (PUA)
Comodo Malware@#1w0ix92xqhrt4
VIPRE Trojan.Win32.Generic!BT
TrendMicro TROJ_GEN.R06BC0WFL21
McAfee-GW-Edition BehavesLike.Win32.Generic.jc
FireEye Generic.mg.41c69a7f93fbe7ed
Emsisoft Trojan.GenericKD.37141241 (B)
Ikarus Trojan.Inject
Jiangmin TrojanDownloader.Zenlod.be
MaxSecure Trojan.Malware.101153295.susgen
Avira TR/AD.Inject.jwrep
Antiy-AVL Trojan/Generic.ASMalwS.339A813
Kingsoft Win32.Troj.Undef.(kcloud)
Gridinsoft Trojan.Win32.Downloader.sa
Microsoft Trojan:Win32/Azorult!ml
AegisLab Trojan.Win32.Zenlod.a!c
GData Trojan.GenericKD.37141241
Cynet Malicious (score: 100)
AhnLab-V3 Trojan/Win.Generic.R426623
McAfee RDN/Generic Downloader.x
MAX malware (ai score=99)
VBA32 TrojanDownloader.Zenlod
Malwarebytes Trojan.Dropper
TrendMicro-HouseCall TROJ_GEN.R06BC0WFL21
Fortinet W32/PossibleThreat
Webroot W32.Trojan.Gen
AVG Win32:DropperX-gen [Drp]
Panda Trj/CI.A