popup
Summary | ZeroBOX
  1. Home
  2. Result
  3. Report
  4. Detail Analysis

pat.exe

VMProtect PE32 PE File
  1. Resubmit sample
Category Machine Started Completed
FILE s1_win7_x6402 July 2, 2021, 4:11 p.m. July 2, 2021, 4:16 p.m.
Size 5.7MB
Type PE32 executable (GUI) Intel 80386, for MS Windows
MD5 571d311fc434e77de22206602a9131d3
SHA256 04a3b0f970d1689d6c1d6859c81ef3f41f1a503baf4275188e848548b2669950
CRC32 FFE090A5
ssdeep 98304:u+F4gz3TK6AWl/7COZo5Bx66vH/6V/wsmgxBrEw1lhDJX6SWE9n4GT9xEr2Rh+e:u+FMWlzCD5npIhmaAUIJE9BTTGK+e
Yara
  • PE_Header_Zero - PE File Signature
  • VMProtect_Zero - VMProtect packed file
  • IsPE32 - (no description)

Name Response Post-Analysis Lookup
antimalwarebyte.xyz
A 185.22.155.64
185.22.155.64
IP Address Status Action
164.124.101.2 Active Moloch
172.217.25.14 Active Moloch
185.22.155.64 Active Moloch

Suricata Alerts

Flow SID Signature Category
TCP 192.168.56.102:49807 -> 185.22.155.64:80 2027104 ET HUNTING Suspicious Zipped Filename in Outbound POST Request (cookies.txt) M2 A Network Trojan was detected

Suricata TLS

No Suricata TLS

registry HKEY_LOCAL_MACHINE\SOFTWARE\Mozilla\Mozilla Firefox
section .vmp0
section .vmp1
suspicious_features POST method with no referer header suspicious_request POST http://antimalwarebyte.xyz/collect.php
request POST http://antimalwarebyte.xyz/collect.php
request POST http://antimalwarebyte.xyz/collect.php
Time & API Arguments Status Return Repeated

NtAllocateVirtualMemory

 process_identifier: 8564
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x00230000
allocation_type: 12288 (MEM_COMMIT|MEM_RESERVE)
process_handle: 0xffffffff
1 0 0

NtProtectVirtualMemory

 process_identifier: 8564
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x73772000
process_handle: 0xffffffff
1 0 0
file C:\Users\test22\AppData\Local\Google\Chrome\User Data\Local State
registry HKEY_LOCAL_MACHINE\SOFTWARE\Mozilla\Mozilla Firefox
Time & API Arguments Status Return Repeated

Process32NextW

 snapshot_handle: 0x000000c0
process_name: mobsync.exe
process_identifier: 3488
1 1 0

Process32NextW

 snapshot_handle: 0x000000c0
process_name: pw.exe
process_identifier: 3516
1 1 0

Process32NextW

 snapshot_handle: 0x000000c0
process_name: taskhost.exe
process_identifier: 7644
1 1 0

Process32NextW

 snapshot_handle: 0x000000c0
process_name: cmd.exe
process_identifier: 9068
1 1 0

Process32NextW

 snapshot_handle: 0x000000c0
process_name: pw.exe
process_identifier: 5628
1 1 0

Process32NextW

 snapshot_handle: 0x000000c0
process_name: pat.exe
process_identifier: 8564
1 1 0

Process32NextW

 snapshot_handle: 0x000000c0
process_name: slui.exe
process_identifier: 7680
1 1 0
section {u'size_of_data': u'0x005b6e00', u'virtual_address': u'0x003e9000', u'entropy': 7.964269757855913, u'name': u'.vmp1', u'virtual_size': u'0x005b6df0'} entropy 7.96426975786 description A section with a high entropy has been found
entropy 0.999743721169 description Overall entropy of this PE file is high
section .vmp0 description Section name indicates VMProtect
section .vmp1 description Section name indicates VMProtect
host 172.217.25.14
file C:\wallet.dat
file C:\Users\test22\AppData\Roaming\Electrum\wallets
Time & API Arguments Status Return Repeated

RegSetValueExA

 key_handle: 0x00000248
regkey_r: ProxyEnable
reg_type: 4 (REG_DWORD)
value: 0
regkey: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ProxyEnable
1 0 0
file C:\Users\Default\AppData\Roaming\FileZilla\sitemanager.xml
file C:\Users\Default User\AppData\Roaming\FileZilla\recentservers.xml
file C:\Users\test22\AppData\Roaming\FileZilla\recentservers.xml
file C:\Users\Default\AppData\Roaming\FileZilla\recentservers.xml
file C:\Users\Public\AppData\Roaming\FileZilla\sitemanager.xml
file C:\Users\Public\AppData\Roaming\FileZilla\recentservers.xml
file C:\Users\Default User\AppData\Roaming\FileZilla\sitemanager.xml
file C:\Users\test22\AppData\Roaming\FileZilla\sitemanager.xml
file C:\Users\All Users\AppData\Roaming\FileZilla\sitemanager.xml
file C:\Users\All Users\AppData\Roaming\FileZilla\recentservers.xml
file C:\Users\All Users\AppData\Roaming\.purple\accounts.xml
file C:\Users\Default User\AppData\Roaming\.purple\accounts.xml
file C:\Users\test22\AppData\Roaming\.purple\accounts.xml
file C:\Users\Default\AppData\Roaming\.purple\accounts.xml
file C:\Users\Public\AppData\Roaming\.purple\accounts.xml
Bkav W32.AIDetect.malware1
Elastic malicious (high confidence)
McAfee Artemis!571D311FC434
Cylance Unsafe
Sangfor Trojan.Win32.Save.a
CrowdStrike win/malicious_confidence_90% (D)
K7GW Trojan ( 7000001c1 )
K7AntiVirus Trojan ( 7000001c1 )
Symantec ML.Attribute.HighConfidence
ESET-NOD32 a variant of Win32/Packed.VMProtect.VH
APEX Malicious
Kaspersky Trojan-PSW.Win32.HashCity.mf
McAfee-GW-Edition BehavesLike.Win32.Backdoor.tc
FireEye Generic.mg.571d311fc434e77d
Sophos Mal/Generic-R + Mal/VMProtBad-A
Ikarus Trojan.Win32.VMProtect
Avira TR/Crypt.XPACK.Gen
Kingsoft Win32.PSWTroj.Undef.(kcloud)
Microsoft Trojan:Win32/Tnega!ml
Cynet Malicious (score: 100)
AhnLab-V3 Trojan/Win.Reputation.R426616
Acronis suspicious
BitDefenderTheta Gen:NN.ZexaF.34770.@BW@auesfFi
Malwarebytes Malware.AI.2723236934
Rising Trojan.Generic@ML.99 (RDML:ozipnu8w60GHoLYNBO6C6w)
SentinelOne Static AI - Malicious PE
MaxSecure Trojan.Malware.300983.susgen
Qihoo-360 HEUR/QVM19.1.4F0F.Malware.Gen