Summary | ZeroBOX

Category	Machine	Started	Completed
FILE	s1_win7_x6401	June 25, 2021, 9:53 a.m.	June 25, 2021, 9:57 a.m.

Size	5.4MB
Type	PE32 executable (GUI) Intel 80386, for MS Windows
MD5	`d070d331925d901996e19fda9f21a44b`
SHA256	`2db34048692a68cbddb227ac062584706a30d093cdb15fabd5179a3d102a2318`
CRC32	`40B4BD45`
ssdeep	`98304:zRq+mR3siVf7T7vg4nUlLWyThN50r4Gs5Z371/DpE2RWH39aCMgEU:2Jf7T7vOh7ThNKuZ37Q2R41`
Yara	PE_Header_Zero - PE File Signature VMProtect_Zero - VMProtect packed file IsPE32 - (no description)

CausticMucous.exe "C:\Users\test22\AppData\Local\Temp\CausticMucous.exe"
2548

Name	Response	Post-Analysis Lookup
down.dh465.cn	A 119.206.200.180 CNAME down.dh465.cn.wsdvs.com	119.206.200.180

IP Address	Status	Action
119.206.200.180	Active	Moloch
164.124.101.2	Active	Moloch

Suricata Alerts

No Suricata Alerts

Suricata TLS

No Suricata TLS

Queries for the computername (1 event)

Time & API	Arguments	Status	Return	Repeated
GetComputerNameW June 25, 2021, 9:52 a.m.	computer_name: TEST22-PC	1	1	0

The executable contains unknown PE section names indicative of a packer (could be a false positive) (2 events)

section	.vmp0
section	.vmp1

One or more potentially interesting buffers were extracted, these generally contain injected code, configuration data, etc.

HTTP traffic contains suspicious features which may be indicative of malware related traffic (2 events)

suspicious_features	GET method with no useragent header				suspicious_request	GET http://down.dh465.cn/GentorBurch.7z
suspicious_features	GET method with no useragent header				suspicious_request	GET http://down.dh465.cn/SetFunVec.7z

Performs some HTTP requests (2 events)

request	GET http://down.dh465.cn/GentorBurch.7z
request	GET http://down.dh465.cn/SetFunVec.7z

Allocates read-write-execute memory (usually to unpack itself) (1 event)

Time & API	Arguments	Status	Return	Repeated
NtAllocateVirtualMemory June 25, 2021, 9:52 a.m.	process_identifier: 2548 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00340000 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0xffffffff	1	0	0

Attempts to modify Internet Explorer's start page (1 event)

registry

HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main\Start Page

Steals private information from local Internet browsers (2 events)

file	C:\Users\test22\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences
file	C:\Users\test22\AppData\Local\Google\Chrome\User Data\Default\Preferences

Foreign language identified in PE resource (1 event)

name

RT_VERSION

language

LANG_CHINESE

filetype

PGP symmetric key encrypted data - Plaintext or unencrypted data

sublanguage

SUBLANG_CHINESE_SIMPLIFIED

offset

0x008e60a0

size

0x0000018c

Creates a shortcut to an executable file (11 events)

file	C:\Users\test22\Desktop\360°²È«ä¯ÀÀÆ÷.lnk
file	C:\Users\Public\Desktop\ÊÀ½çÖ®´°.lnk
file	C:\Users\test22\Desktop\ÊÀ½çÖ®´°.lnk
file	C:\Users\test22\Desktop\360¼«ËÙä¯ÀÀÆ÷.lnk
file	C:\Users\test22\Desktop\ÍòÄÜä¯ÀÀÆ÷.lnk
file	C:\Users\Public\Desktop\hao123½Û×Óä¯ÀÀÆ÷.lnk
file	C:\Users\Public\Desktop\½Û×Óä¯ÀÀÆ÷.lnk
file	C:\Users\Public\Desktop\ÍòÄÜä¯ÀÀÆ÷.lnk
file	C:\Users\test22\Desktop\ÊÀ½çÖ®´° 3.lnk
file	C:\Users\Public\Desktop\ÊÀ½çÖ®´° 3.lnk
file	C:\Users\test22\Desktop\360°²È«ä¯ÀÀÆ÷7.lnk

Searches running processes potentially to identify processes for sandbox evasion, code injection or memory dumping (25 events)

Time & API	Arguments	Status	Return
Process32NextW June 25, 2021, 9:52 a.m.	snapshot_handle: 0x00000074 process_name: mobsync.exe process_identifier: 2064	1	1
Process32NextW June 25, 2021, 9:52 a.m.	snapshot_handle: 0x00000074 process_name: pw.exe process_identifier: 3060	1	1
Process32NextW June 25, 2021, 9:52 a.m.	snapshot_handle: 0x00000074 process_name: taskhost.exe process_identifier: 1340	1	1
Process32NextW June 25, 2021, 9:52 a.m.	snapshot_handle: 0x00000074 process_name: CausticMucous.exe process_identifier: 7536752		0
Process32NextW June 25, 2021, 9:52 a.m.	snapshot_handle: 0x0000007c process_name: CausticMucous.exe process_identifier: 7536688		0
Process32NextW June 25, 2021, 9:52 a.m.	snapshot_handle: 0x00000080 process_name: CausticMucous.exe process_identifier: 7602224		0
Process32NextW June 25, 2021, 9:52 a.m.	snapshot_handle: 0x00000088 process_name: e process_identifier: 6553717		0
Process32NextW June 25, 2021, 9:52 a.m.	snapshot_handle: 0x00000138 process_name: CausticMucous.exe process_identifier: 7471170		0
Process32NextW June 25, 2021, 9:52 a.m.	snapshot_handle: 0x00000168 process_name: CausticMucous.exe process_identifier: 6488112		0
Process32NextW June 25, 2021, 9:52 a.m.	snapshot_handle: 0x00000168 process_name: e process_identifier: 7274599		0
Process32NextW June 25, 2021, 9:52 a.m.	snapshot_handle: 0x00000168 process_name: CausticMucous.exe process_identifier: 7274610		0
Process32NextW June 25, 2021, 9:52 a.m.	snapshot_handle: 0x00000174 process_name: CausticMucous.exe process_identifier: 6619250		0
Process32NextW June 25, 2021, 9:52 a.m.	snapshot_handle: 0x00000174 process_name: CausticMucous.exe process_identifier: 7471202		0
Process32NextW June 25, 2021, 9:52 a.m.	snapshot_handle: 0x00000178 process_name: CausticMucous.exe process_identifier: 7471205		0
Process32NextW June 25, 2021, 9:52 a.m.	snapshot_handle: 0x00000178 process_name: CausticMucous.exe process_identifier: 6422629		0
Process32NextW June 25, 2021, 9:52 a.m.	snapshot_handle: 0x00000178 process_name: CausticMucous.exe process_identifier: 5701733		0
Process32NextW June 25, 2021, 9:52 a.m.	snapshot_handle: 0x00000178 process_name: process_identifier: 6553705		0
Process32NextW June 25, 2021, 9:52 a.m.	snapshot_handle: 0x000001cc process_name: CausticMucous.exe process_identifier: 6881402		0
Process32NextW June 25, 2021, 9:52 a.m.	snapshot_handle: 0x000001cc process_name: CausticMucous.exe process_identifier: 3211375		0
Process32NextW June 25, 2021, 9:52 a.m.	snapshot_handle: 0x000001cc process_name: CausticMucous.exe process_identifier: 5439536		0
Process32NextW June 25, 2021, 9:52 a.m.	snapshot_handle: 0x000001cc process_name: CausticMucous.exe process_identifier: 4390992		0
Process32NextW June 25, 2021, 9:52 a.m.	snapshot_handle: 0x000001cc process_name: CausticMucous.exe process_identifier: 7602277		0
Process32NextW June 25, 2021, 9:52 a.m.	snapshot_handle: 0x000001cc process_name: CausticMucous.exe process_identifier: 7536741		0
Process32NextW June 25, 2021, 9:52 a.m.	snapshot_handle: 0x000001cc process_name: CausticMucous.exe process_identifier: 7602296		0
Process32NextW June 25, 2021, 9:52 a.m.	snapshot_handle: 0x000001cc process_name: CausticMucous.exe process_identifier: 4522057		0

Changes read-write memory protection to read-execute (probably to avoid detection when setting all RWX flags at the same time) (1 event)

Time & API	Arguments	Status	Return	Repeated
NtProtectVirtualMemory June 25, 2021, 9:52 a.m.	process_identifier: 2548 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 length: 167936 protection: 32 (PAGE_EXECUTE_READ) base_address: 0x10001000 process_handle: 0xffffffff	1	0	0

The binary likely contains encrypted or compressed data indicative of a packer (2 events)

section

{u'size_of_data': u'0x0056e800', u'virtual_address': u'0x00376000', u'entropy': 7.957996805359945, u'name': u'.vmp1', u'virtual_size': u'0x0056e730'}

entropy

7.95799680536

description

A section with a high entropy has been found

entropy

0.999550723335

description

Overall entropy of this PE file is high

Repeatedly searches for a not-found process, you may want to run a web browser during analysis (34 events)

Time & API	Arguments	Status	Return	Repeated
Process32NextW June 25, 2021, 9:52 a.m.	snapshot_handle: 0x00000074 process_name: CausticMucous.exe process_identifier: 7536752		0	0
Process32NextW June 25, 2021, 9:52 a.m.	snapshot_handle: 0x00000078 process_name: CausticMucous.exe process_identifier: 7536752		0	0
Process32NextW June 25, 2021, 9:52 a.m.	snapshot_handle: 0x0000007c process_name: CausticMucous.exe process_identifier: 7536688		0	0
Process32NextW June 25, 2021, 9:52 a.m.	snapshot_handle: 0x00000080 process_name: CausticMucous.exe process_identifier: 7602224		0	0
Process32NextW June 25, 2021, 9:52 a.m.	snapshot_handle: 0x00000084 process_name: CausticMucous.exe process_identifier: 7536688		0	0
Process32NextW June 25, 2021, 9:52 a.m.	snapshot_handle: 0x00000088 process_name: e process_identifier: 6553717		0	0
Process32NextW June 25, 2021, 9:52 a.m.	snapshot_handle: 0x00000138 process_name: CausticMucous.exe process_identifier: 7471170		0	0
Process32NextW June 25, 2021, 9:52 a.m.	snapshot_handle: 0x00000130 process_name: CausticMucous.exe process_identifier: 7536688		0	0
Process32NextW June 25, 2021, 9:52 a.m.	snapshot_handle: 0x00000168 process_name: CausticMucous.exe process_identifier: 6488112		0	0
Process32NextW June 25, 2021, 9:52 a.m.	snapshot_handle: 0x00000168 process_name: e process_identifier: 7274599		0	0
Process32NextW June 25, 2021, 9:52 a.m.	snapshot_handle: 0x00000168 process_name: CausticMucous.exe process_identifier: 7274610		0	0
Process32NextW June 25, 2021, 9:52 a.m.	snapshot_handle: 0x00000168 process_name: CausticMucous.exe process_identifier: 7274610		0	0
Process32NextW June 25, 2021, 9:52 a.m.	snapshot_handle: 0x00000174 process_name: CausticMucous.exe process_identifier: 6619250		0	0
Process32NextW June 25, 2021, 9:52 a.m.	snapshot_handle: 0x00000174 process_name: CausticMucous.exe process_identifier: 7471202		0	0
Process32NextW June 25, 2021, 9:52 a.m.	snapshot_handle: 0x00000178 process_name: CausticMucous.exe process_identifier: 7471202		0	0
Process32NextW June 25, 2021, 9:52 a.m.	snapshot_handle: 0x00000178 process_name: CausticMucous.exe process_identifier: 7471205		0	0
Process32NextW June 25, 2021, 9:52 a.m.	snapshot_handle: 0x00000178 process_name: CausticMucous.exe process_identifier: 6422629		0	0
Process32NextW June 25, 2021, 9:52 a.m.	snapshot_handle: 0x00000178 process_name: CausticMucous.exe process_identifier: 5701733		0	0
Process32NextW June 25, 2021, 9:52 a.m.	snapshot_handle: 0x00000178 process_name: process_identifier: 6553705		0	0
Process32NextW June 25, 2021, 9:52 a.m.	snapshot_handle: 0x000001cc process_name: CausticMucous.exe process_identifier: 6881402		0	0
Process32NextW June 25, 2021, 9:52 a.m.	snapshot_handle: 0x000001cc process_name: CausticMucous.exe process_identifier: 3211375		0	0
Process32NextW June 25, 2021, 9:52 a.m.	snapshot_handle: 0x000001cc process_name: CausticMucous.exe process_identifier: 7602224		0	0
Process32NextW June 25, 2021, 9:52 a.m.	snapshot_handle: 0x000001cc process_name: CausticMucous.exe process_identifier: 5439536		0	0
Process32NextW June 25, 2021, 9:52 a.m.	snapshot_handle: 0x000001cc process_name: CausticMucous.exe process_identifier: 4390992		0	0
Process32NextW June 25, 2021, 9:52 a.m.	snapshot_handle: 0x000001cc process_name: CausticMucous.exe process_identifier: 7602277		0	0
Process32NextW June 25, 2021, 9:52 a.m.	snapshot_handle: 0x000001cc process_name: CausticMucous.exe process_identifier: 7536741		0	0
Process32NextW June 25, 2021, 9:52 a.m.	snapshot_handle: 0x000001cc process_name: CausticMucous.exe process_identifier: 7602296		0	0
Process32NextW June 25, 2021, 9:52 a.m.	snapshot_handle: 0x000001cc process_name: CausticMucous.exe process_identifier: 7602296		0	0
Process32NextW June 25, 2021, 9:52 a.m.	snapshot_handle: 0x000001cc process_name: CausticMucous.exe process_identifier: 7602224		0	0
Process32NextW June 25, 2021, 9:52 a.m.	snapshot_handle: 0x000001cc process_name: CausticMucous.exe process_identifier: 5439536		0	0
Process32NextW June 25, 2021, 9:52 a.m.	snapshot_handle: 0x000001cc process_name: CausticMucous.exe process_identifier: 4390992		0	0
Process32NextW June 25, 2021, 9:52 a.m.	snapshot_handle: 0x000001cc process_name: CausticMucous.exe process_identifier: 7602277		0	0
Process32NextW June 25, 2021, 9:52 a.m.	snapshot_handle: 0x000001cc process_name: CausticMucous.exe process_identifier: 7536741		0	0
Process32NextW June 25, 2021, 9:52 a.m.	snapshot_handle: 0x000001cc process_name: CausticMucous.exe process_identifier: 4522057		0	0

Queries for potentially installed applications (10 events)

Time & API	Arguments	Return
RegOpenKeyExA June 25, 2021, 9:52 a.m.	regkey_r: Software\Microsoft\Windows\CurrentVersion\Uninstall\360se6 base_handle: 0x80000001 key_handle: 0x00000000 options: 0 access: 0x00000001 regkey: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Uninstall\360se6	2
RegOpenKeyExA June 25, 2021, 9:52 a.m.	regkey_r: Software\Microsoft\Windows\CurrentVersion\Uninstall\360Chrome base_handle: 0x80000001 key_handle: 0x00000000 options: 0 access: 0x00000001 regkey: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Uninstall\360Chrome	2
RegOpenKeyExA June 25, 2021, 9:52 a.m.	regkey_r: Software\Microsoft\Windows\CurrentVersion\Uninstall\360Chrome base_handle: 0x80000001 key_handle: 0x00000000 options: 0 access: 0x00000001 regkey: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Uninstall\360Chrome	2
RegOpenKeyExA June 25, 2021, 9:52 a.m.	regkey_r: Software\Microsoft\Windows\CurrentVersion\Uninstall\360Chrome base_handle: 0x80000001 key_handle: 0x00000000 options: 0 access: 0x00000001 regkey: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Uninstall\360Chrome	2
RegOpenKeyExA June 25, 2021, 9:52 a.m.	regkey_r: SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\ÍòÄÜä¯ÀÀÆ÷ base_handle: 0x80000002 key_handle: 0x00000000 options: 0 access: 0x00000001 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\ￍ￲ￄￜ￤ﾯ￀￀ￆ￷	2
RegOpenKeyExA June 25, 2021, 9:52 a.m.	regkey_r: SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\ÍòÄÜä¯ÀÀÆ÷ base_handle: 0x80000002 key_handle: 0x00000000 options: 0 access: 0x00000001 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\ￍ￲ￄￜ￤ﾯ￀￀ￆ￷	2
RegOpenKeyExA June 25, 2021, 9:52 a.m.	regkey_r: SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\ÍòÄÜä¯ÀÀÆ÷ base_handle: 0x80000002 key_handle: 0x00000000 options: 0 access: 0x00000001 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\ￍ￲ￄￜ￤ﾯ￀￀ￆ￷	2
RegOpenKeyExA June 25, 2021, 9:52 a.m.	regkey_r: SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\ÍòÄÜä¯ÀÀÆ÷ base_handle: 0x80000002 key_handle: 0x00000000 options: 0 access: 0x00000001 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\ￍ￲ￄￜ￤ﾯ￀￀ￆ￷	2
RegOpenKeyExA June 25, 2021, 9:52 a.m.	regkey_r: SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\ÍòÄÜä¯ÀÀÆ÷ base_handle: 0x80000002 key_handle: 0x00000000 options: 0 access: 0x00000001 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\ￍ￲ￄￜ￤ﾯ￀￀ￆ￷	2
RegOpenKeyExA June 25, 2021, 9:52 a.m.	regkey_r: SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\ÍòÄÜä¯ÀÀÆ÷ base_handle: 0x80000002 key_handle: 0x00000000 options: 0 access: 0x00000001 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\ￍ￲ￄￜ￤ﾯ￀￀ￆ￷	2

The executable is likely packed with VMProtect (2 events)

section	.vmp0				description	Section name indicates VMProtect
section	.vmp1				description	Section name indicates VMProtect

File has been identified by 44 AntiVirus engines on VirusTotal as malicious (44 events)

Bkav	W32.AIDetect.malware1
Elastic	malicious (high confidence)
MicroWorld-eScan	Gen:Variant.Symmi.91502
FireEye	Generic.mg.d070d331925d9019
CAT-QuickHeal	TrojanDownloader.Agent
McAfee	Artemis!D070D331925D
Cylance	Unsafe
Sangfor	Riskware.Win32.Agent.ky
K7AntiVirus	Trojan ( 7000001c1 )
Alibaba	TrojanDownloader:Win32/VMProtBad.4fa43e61
K7GW	Trojan ( 7000001c1 )
Cybereason	malicious.1925d9
BitDefenderTheta	Gen:NN.ZexaF.34758.@F0@aipzYJmj
Symantec	ML.Attribute.HighConfidence
APEX	Malicious
Avast	Win32:Malware-gen
Kaspersky	Trojan-Downloader.Win32.Agent.xxzrbu
BitDefender	Gen:Variant.Symmi.91502
Paloalto	generic.ml
AegisLab	Trojan.Win32.Agent.a!c
Ad-Aware	Gen:Variant.Symmi.91502
Emsisoft	Gen:Variant.Symmi.91502 (B)
TrendMicro	TROJ_GEN.R002C0RFJ21
McAfee-GW-Edition	BehavesLike.Win32.Trojan.tc
Sophos	Mal/VMProtBad-A
Ikarus	Trojan-Downloader.Agent
Avira	TR/Dldr.Agent.ouwqb
Kingsoft	Win32.TrojDownloader.Agent.(kcloud)
Microsoft	Trojan:Win32/Tnega!ml
GData	Gen:Variant.Symmi.91502
Cynet	Malicious (score: 99)
AhnLab-V3	Malware/Win.Reputation.C4397668
VBA32	TScope.Malware-Cryptor.SB
ALYac	Gen:Variant.Symmi.91502
MAX	malware (ai score=89)
Malwarebytes	Malware.AI.1983729254
TrendMicro-HouseCall	TROJ_GEN.R002C0RFJ21
Rising	Trojan.Generic@ML.100 (RDML:L/xjKuZvbxL4DOO0vXoZ3Q)
SentinelOne	Static AI - Malicious PE
eGambit	Unsafe.AI_Score_95%
Fortinet	W32/Agent.XXZRBU!tr.dldr
MaxSecure	Trojan.Malware.119052892.susgen
AVG	Win32:Malware-gen
CrowdStrike	win/malicious_confidence_100% (W)

CausticMucous.exe

Process Tree Toggle all

Network Toggle all

Suricata Toggle all

Suricata Alerts

Suricata TLS

Signatures Toggle All