popup
Summary | ZeroBOX
  1. Home
  2. Result
  3. Report
  4. Detail Analysis

doc75843.exe

NSIS Admin Tool (Sysinternals etc ...) PE32 PE File DLL
  1. Resubmit sample
Category Machine Started Completed
FILE s1_win7_x6401 June 26, 2021, 10:42 a.m. June 26, 2021, 10:42 a.m.
Size 246.0KB
Type PE32 executable (GUI) Intel 80386, for MS Windows, Nullsoft Installer self-extracting archive
MD5 765b1bb3690c9bacdfa38e18d788efbf
SHA256 a3703cc485d2a99cfec122203ed2d7dd83274af8bd0b3bcfab3fd590dd5c308c
CRC32 1B23E4D6
ssdeep 6144:MTqjFAdWMbSChmll5dKk3jQXzk0KX03SfFnEx:MZdWuS3FBjQXzkVX0OEx
Yara
  • NSIS_Installer - Null Soft Installer
  • IsPE32 - (no description)
  • Admin_Tool_IN_Zero - Admin Tool Sysinternals
  • PE_Header_Zero - PE File Signature

Name Response Post-Analysis Lookup
No hosts contacted.
IP Address Status Action
164.124.101.2 Active Moloch

Suricata Alerts

No Suricata Alerts

Suricata TLS

No Suricata TLS

Time & API Arguments Status Return Repeated

GlobalMemoryStatusEx

 1 1 0
section .ndata
Time & API Arguments Status Return Repeated

NtProtectVirtualMemory

 process_identifier: 2220
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x10004000
process_handle: 0xffffffff
1 0 0

NtProtectVirtualMemory

 process_identifier: 2220
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x10004000
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 1972
region_size: 3158016
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x00820000
allocation_type: 12288 (MEM_COMMIT|MEM_RESERVE)
process_handle: 0xffffffff
1 0 0
file C:\Users\test22\AppData\Local\Temp\nst62FB.tmp\System.dll
file C:\Users\test22\AppData\Local\Temp\nst62FB.tmp\System.dll
Time & API Arguments Status Return Repeated

LookupPrivilegeValueW

 system_name:
privilege_name: SeDebugPrivilege
1 1 0
Process injection Process 2220 called NtSetContextThread to modify thread in remote process 1972
Time & API Arguments Status Return Repeated

NtSetContextThread

 registers.eip: 2000355780
registers.esp: 1638384
registers.edi: 0
registers.eax: 4320176
registers.ebp: 0
registers.edx: 0
registers.ebx: 2130567168
registers.esi: 0
registers.ecx: 0
thread_handle: 0x000001f4
process_identifier: 1972
1 0 0
Cylance Unsafe
Sangfor Spyware.Win32.Noon.gen
K7AntiVirus Riskware ( 0040eff71 )
K7GW Riskware ( 0040eff71 )
Cybereason malicious.57ddec
Symantec Trojan.Gen.2
APEX Malicious
Paloalto generic.ml
Ad-Aware Dropped:Trojan.Zuf.1.Gen
Sophos Mal/Generic-S
F-Secure Trojan.TR/AD.Swotter.tutmr
DrWeb Trojan.Loader.850
Ikarus Win32.SuspectCrc
Kingsoft Win32.Troj.Undef.(kcloud)
Gridinsoft Risk.Win32.CoinMiner.sd!s1
Microsoft TrojanSpy:Win32/Swotter.A!bit
Cynet Malicious (score: 100)
AhnLab-V3 Malware/Win.Generic.C4534474
TrendMicro-HouseCall TROJ_GEN.F0D1C00FP21
SentinelOne Static AI - Malicious PE
Fortinet W32/Kryptik.J!tr