Summary | ZeroBOX

Category	Machine	Started	Completed
FILE	s1_win7_x6401	June 25, 2021, 10:10 a.m.	June 25, 2021, 10:30 a.m.

Size	23.5KB
Type	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
MD5	`ddc374b71d64ae7354127b3074c4a56f`
SHA256	`ad7020989be5182409d6cc2498a03833a4b5b7d81ed9d37b65a6f9fe04538407`
CRC32	`41754BFB`
ssdeep	`384:SJze+nR6vRKXGYKRVVSujU0a9w6agwot3GDVmRvR6JZlbw8hqIusZzZT1:xI65K2Ys1jiRpcnuO`
Yara	Win_Backdoor_njRAT_Zero - Win Backdoor njRAT PE_Header_Zero - PE File Signature Is_DotNET_EXE - (no description) Generic_Malware_Zero - Generic Malware IsPE32 - (no description)

SVBN2.exe "C:\Users\test22\AppData\Local\Temp\SVBN2.exe"
2548
netsh.exe netsh firewall add allowedprogram "C:\ProgramData\Window Update.exe" "Window Update.exe" ENABLE
2044

Name	Response	Post-Analysis Lookup
No hosts contacted.

IP Address	Status	Action
103.70.5.247	Active	Moloch
164.124.101.2	Active	Moloch

Suricata Alerts

Flow	SID	Signature	Category
TCP 192.168.56.101:49204 -> 103.70.5.247:5555	2033132	ET MALWARE Generic njRAT/Bladabindi CnC Activity (ll)	Malware Command and Control Activity Detected

Suricata TLS

No Suricata TLS

Checks if process is being debugged by a debugger (1 event)

Time & API	Arguments	Status	Return	Repeated
IsDebuggerPresent June 25, 2021, 10:01 a.m.			0	0

Command line console output was observed (2 events)

Time & API	Arguments	Status	Return	Repeated
WriteConsoleA June 25, 2021, 10:01 a.m.	buffer: IMPORTANT: Command executed successfully. However, "netsh firewall" is deprecated; use "netsh advfirewall firewall" instead. For more information on using "netsh advfirewall firewall" commands instead of "netsh firewall", see KB article 947709 at http://go.microsoft.com/fwlink/?linkid=121488 . console_handle: 0x00000007	1	1	0
WriteConsoleA June 25, 2021, 10:01 a.m.	buffer: Ok. console_handle: 0x00000007	1	1	0

Allocates read-write-execute memory (usually to unpack itself) (18 events)

Time & API	Arguments	Status
NtAllocateVirtualMemory June 25, 2021, 10:01 a.m.	process_identifier: 2548 region_size: 1507328 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00710000 allocation_type: 8192 (MEM_RESERVE) process_handle: 0xffffffff	1
NtAllocateVirtualMemory June 25, 2021, 10:01 a.m.	process_identifier: 2548 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00840000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtProtectVirtualMemory June 25, 2021, 10:01 a.m.	process_identifier: 2548 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x72831000 process_handle: 0xffffffff	1
NtAllocateVirtualMemory June 25, 2021, 10:01 a.m.	process_identifier: 2548 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0056a000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtProtectVirtualMemory June 25, 2021, 10:01 a.m.	process_identifier: 2548 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 8192 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x72832000 process_handle: 0xffffffff	1
NtAllocateVirtualMemory June 25, 2021, 10:01 a.m.	process_identifier: 2548 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00562000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory June 25, 2021, 10:01 a.m.	process_identifier: 2548 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00572000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory June 25, 2021, 10:01 a.m.	process_identifier: 2548 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00573000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory June 25, 2021, 10:01 a.m.	process_identifier: 2548 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x005ab000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory June 25, 2021, 10:01 a.m.	process_identifier: 2548 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x005a7000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory June 25, 2021, 10:01 a.m.	process_identifier: 2548 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0057c000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory June 25, 2021, 10:01 a.m.	process_identifier: 2548 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00c10000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory June 25, 2021, 10:01 a.m.	process_identifier: 2548 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00574000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory June 25, 2021, 10:01 a.m.	process_identifier: 2548 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00575000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory June 25, 2021, 10:01 a.m.	process_identifier: 2548 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00576000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory June 25, 2021, 10:01 a.m.	process_identifier: 2548 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0059a000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory June 25, 2021, 10:01 a.m.	process_identifier: 2548 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00592000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory June 25, 2021, 10:01 a.m.	process_identifier: 2548 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0057a000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1

Creates executable files on the filesystem (1 event)

file	C:\ProgramData\Window Update.exe

Drops a binary and executes it (1 event)

file	C:\ProgramData\Window Update.exe

Communicates with host for which no DNS query was performed (1 event)

host

103.70.5.247

File has been identified by 57 AntiVirus engines on VirusTotal as malicious (50 out of 57 events)

Bkav	W32.FamVT.binANHb.Worm
Elastic	malicious (high confidence)
DrWeb	BackDoor.Bladabindi.13678
MicroWorld-eScan	Generic.MSIL.Bladabindi.E046A3C6
FireEye	Generic.mg.ddc374b71d64ae73
CAT-QuickHeal	Backdoor.Bladabindi.AL3
McAfee	Trojan-FIGN
Cylance	Unsafe
Zillya	Trojan.Disfa.Win32.27264
Sangfor	Trojan.Win32.Save.a
K7AntiVirus	Trojan ( 700000121 )
Alibaba	Trojan:Win32/Bladabindi.374
K7GW	Trojan ( 700000121 )
Cybereason	malicious.71d64a
Arcabit	Generic.MSIL.Bladabindi.E046A3C6
BitDefenderTheta	Gen:NN.ZemsilF.34758.bmW@aGp3MJg
Cyren	W32/MSIL_Bladabindi.AU.gen!Eldorado
Symantec	Backdoor.Ratenjay
ESET-NOD32	a variant of MSIL/Bladabindi.AS
APEX	Malicious
Avast	MSIL:Agent-DRD [Trj]
ClamAV	Win.Trojan.B-468
Kaspersky	HEUR:Trojan.Win32.Generic
BitDefender	Generic.MSIL.Bladabindi.E046A3C6
NANO-Antivirus	Trojan.Win32.Disfa.dtznyx
Paloalto	generic.ml
ViRobot	Backdoor.Win32.Bladabindi.Gen.A
Rising	Backdoor.Njrat!1.9E49 (CLASSIC)
Ad-Aware	Generic.MSIL.Bladabindi.E046A3C6
Emsisoft	Trojan.Bladabindi (A)
Comodo	Backdoor.MSIL.Bladabindi.A@566ygc
Baidu	MSIL.Backdoor.Bladabindi.a
VIPRE	Backdoor.MSIL.Bladabindi.a (v)
TrendMicro	BKDR_BLADABI.SMC
McAfee-GW-Edition	BehavesLike.Win32.Trojan.mm
Sophos	ML/PE-A + Troj/Bbindi-W
SentinelOne	Static AI - Malicious PE
Jiangmin	TrojanDropper.Autoit.dce
Avira	TR/Dropper.Gen7
MAX	malware (ai score=84)
Microsoft	Backdoor:MSIL/Bladabindi
AegisLab	Trojan.Win32.Generic.mAmC
GData	MSIL.Backdoor.Bladabindi.AV
Cynet	Malicious (score: 100)
AhnLab-V3	Win-Trojan/Zbot.24064
Acronis	suspicious
ALYac	Generic.MSIL.Bladabindi.E046A3C6
Malwarebytes	Backdoor.NJRat
TrendMicro-HouseCall	BKDR_BLADABI.SMC
Tencent	Win32.Trojan.Generic.Wvuh

SVBN2.exe

Process Tree Toggle all

Network Toggle all

Suricata Toggle all

Suricata Alerts

Suricata TLS

Signatures Toggle All