Summary | ZeroBOX

Category	Machine	Started	Completed
FILE	s1_win7_x6402	Aug. 3, 2021, 9:09 a.m.	Aug. 3, 2021, 9:19 a.m.

Size	96.0KB
Type	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
MD5	`0a3a43c545b504fca1908688bbe661a4`
SHA256	`6f14dcd1c276f021ae900501a048f461ff849ef59dbc860339911a28ace7c757`
CRC32	`F6BD1222`
ssdeep	`1536:mHB+zRmEOBKQUcSXWMiQ/HVWBRs3mW1kxSSmbf9Ba3xHTPyHddY83EtxbIj8EnGq:mwzRmE1QULWMiQ/QBRs3fkxSX1KxHbyn`
Yara	Win32_Trojan_PWS_Net_1_Zero - Win32 Trojan PWS .NET Azorult PE_Header_Zero - PE File Signature OS_Processor_Check_Zero - OS Processor Check Generic_Malware_Zero - Generic Malware Is_DotNET_EXE - (no description) UPX_Zero - UPX packed file IsPE32 - (no description) Win_Backdoor_AsyncRAT_Zero - Win Backdoor AsyncRAT

babkaaepta.exe "C:\Users\test22\AppData\Local\Temp\babkaaepta.exe"
1596

Name	Response	Post-Analysis Lookup
No hosts contacted.

IP Address	Status	Action
185.186.142.55	Active	Moloch

Suricata Alerts

No Suricata Alerts

Suricata TLS

No Suricata TLS

Checks if process is being debugged by a debugger (2 events)

Time & API	Arguments	Status	Return	Repeated
IsDebuggerPresent Aug. 3, 2021, 9:09 a.m.			0	0
IsDebuggerPresent Aug. 3, 2021, 9:09 a.m.			0	0

Uses Windows APIs to generate a cryptographic key (3 events)

Time & API	Arguments	Status	Return
CryptExportKey Aug. 3, 2021, 9:09 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x00654e88 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Aug. 3, 2021, 9:09 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x00654e88 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Aug. 3, 2021, 9:09 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x00654f08 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1

Checks amount of memory in system, this can be used to detect virtual machines that have a low amount of memory available (1 event)

Time & API	Arguments	Status	Return	Repeated
GlobalMemoryStatusEx Aug. 3, 2021, 9:09 a.m.		1	1	0

Allocates read-write-execute memory (usually to unpack itself) (28 events)

Time & API	Arguments	Status
NtAllocateVirtualMemory Aug. 3, 2021, 9:09 a.m.	process_identifier: 1596 region_size: 393216 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00440000 allocation_type: 8192 (MEM_RESERVE) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Aug. 3, 2021, 9:09 a.m.	process_identifier: 1596 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00460000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtProtectVirtualMemory Aug. 3, 2021, 9:09 a.m.	process_identifier: 1596 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x73a71000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Aug. 3, 2021, 9:09 a.m.	process_identifier: 1596 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x73a72000 process_handle: 0xffffffff	1
NtAllocateVirtualMemory Aug. 3, 2021, 9:09 a.m.	process_identifier: 1596 region_size: 1114112 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00a80000 allocation_type: 8192 (MEM_RESERVE) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Aug. 3, 2021, 9:09 a.m.	process_identifier: 1596 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00b50000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Aug. 3, 2021, 9:09 a.m.	process_identifier: 1596 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00452000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Aug. 3, 2021, 9:09 a.m.	process_identifier: 1596 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x004c5000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Aug. 3, 2021, 9:09 a.m.	process_identifier: 1596 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x004cb000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Aug. 3, 2021, 9:09 a.m.	process_identifier: 1596 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x004c7000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Aug. 3, 2021, 9:09 a.m.	process_identifier: 1596 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x004ac000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Aug. 3, 2021, 9:09 a.m.	process_identifier: 1596 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x008c0000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Aug. 3, 2021, 9:09 a.m.	process_identifier: 1596 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x004b6000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Aug. 3, 2021, 9:09 a.m.	process_identifier: 1596 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x004ba000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Aug. 3, 2021, 9:09 a.m.	process_identifier: 1596 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x004b7000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Aug. 3, 2021, 9:09 a.m.	process_identifier: 1596 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0045a000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Aug. 3, 2021, 9:09 a.m.	process_identifier: 1596 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x004bb000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Aug. 3, 2021, 9:09 a.m.	process_identifier: 1596 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x004aa000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Aug. 3, 2021, 9:09 a.m.	process_identifier: 1596 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x004bc000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Aug. 3, 2021, 9:09 a.m.	process_identifier: 1596 region_size: 327680 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x7ef50000 allocation_type: 1056768 (MEM_RESERVE\|MEM_TOP_DOWN) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Aug. 3, 2021, 9:09 a.m.	process_identifier: 1596 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x7ef50000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Aug. 3, 2021, 9:09 a.m.	process_identifier: 1596 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x7ef50000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Aug. 3, 2021, 9:09 a.m.	process_identifier: 1596 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x7ef58000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Aug. 3, 2021, 9:09 a.m.	process_identifier: 1596 region_size: 65536 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x7ef40000 allocation_type: 1056768 (MEM_RESERVE\|MEM_TOP_DOWN) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Aug. 3, 2021, 9:09 a.m.	process_identifier: 1596 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x7ef40000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Aug. 3, 2021, 9:09 a.m.	process_identifier: 1596 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x004b8000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Aug. 3, 2021, 9:09 a.m.	process_identifier: 1596 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x004bd000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Aug. 3, 2021, 9:09 a.m.	process_identifier: 1596 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x004cc000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1

Checks adapter addresses which can be used to detect virtual network interfaces (1 event)

Time & API	Arguments	Status	Return	Repeated
GetAdaptersAddresses Aug. 3, 2021, 9:09 a.m.	flags: 15 family: 0		111	0

Communicates with host for which no DNS query was performed (1 event)

host

185.186.142.55

File has been identified by 48 AntiVirus engines on VirusTotal as malicious (48 events)

Lionic	Trojan.MSIL.Reline.i!c
Elastic	malicious (high confidence)
MicroWorld-eScan	Gen:Variant.Bulz.563852
FireEye	Generic.mg.0a3a43c545b504fc
ALYac	Gen:Variant.Bulz.563852
Cylance	Unsafe
Sangfor	Infostealer.MSIL.Reline.gen
K7AntiVirus	Spyware ( 0057a2c81 )
Alibaba	TrojanPSW:MSIL/Reline.99d563a5
K7GW	Spyware ( 0057a2c81 )
CrowdStrike	win/malicious_confidence_90% (W)
Cyren	W32/MSIL_Agent.BJO.gen!Eldorado
ESET-NOD32	a variant of MSIL/Spy.Agent.DFY
APEX	Malicious
Paloalto	generic.ml
ClamAV	Win.Malware.Bulz-9880537-0
Kaspersky	HEUR:Trojan-PSW.MSIL.Reline.gen
BitDefender	Gen:Variant.Bulz.563852
Avast	Win32:PWSX-gen [Trj]
Rising	Stealer.Agent!1.D483 (CLASSIC)
Ad-Aware	Gen:Variant.Bulz.563852
Sophos	Mal/Generic-S + Mal/Reline-B
DrWeb	Trojan.PWS.StealerNET.103
TrendMicro	TROJ_GEN.R06CC0PGM21
McAfee-GW-Edition	BehavesLike.Win32.Generic.nm
Emsisoft	Gen:Variant.Bulz.563852 (B)
SentinelOne	Static AI - Suspicious PE
Jiangmin	Trojan.PSW.MSIL.cala
Avira	HEUR/AGEN.1140572
MAX	malware (ai score=82)
Antiy-AVL	Trojan/Generic.ASMalwS.3428668
Microsoft	Trojan:Win32/AgentTesla!ml
GData	MSIL.Trojan.PSE.GAWPT8
Cynet	Malicious (score: 100)
AhnLab-V3	Infostealer/Win.RedLine.R433153
McAfee	GenericRXOY-GA!0A3A43C545B5
VBA32	TScope.Trojan.MSIL
Malwarebytes	Spyware.PasswordStealer
TrendMicro-HouseCall	TROJ_GEN.R06CC0PGM21
Tencent	Win32.Trojan.Bulz.Eyk
Yandex	TrojanSpy.Agent!auef3xrYhbA
Ikarus	Trojan-Spy.MSIL.Agent
MaxSecure	Trojan.Malware.300983.susgen
Fortinet	MSIL/Agent.DFY!tr.spy
BitDefenderTheta	Gen:NN.ZemsilF.34050.gm0@aSJveld
AVG	Win32:PWSX-gen [Trj]
Panda	Trj/GdSda.A
Qihoo-360	Win32/TrojanPSW.Generic.HwMAx1sA

Connects to IP addresses that are no longer responding to requests (legitimate services will remain up-and-running usually) (43 events)

dead_host	192.168.56.102:49187
dead_host	192.168.56.102:49205
dead_host	192.168.56.102:49167
dead_host	192.168.56.102:49196
dead_host	192.168.56.102:49176
dead_host	192.168.56.102:49191
dead_host	192.168.56.102:49171
dead_host	192.168.56.102:49200
dead_host	192.168.56.102:49162
dead_host	192.168.56.102:49180
dead_host	192.168.56.102:49195
dead_host	192.168.56.102:49175
dead_host	192.168.56.102:49186
dead_host	192.168.56.102:49204
dead_host	192.168.56.102:49166
dead_host	192.168.56.102:49199
dead_host	192.168.56.102:49179
dead_host	192.168.56.102:49190
dead_host	192.168.56.102:49170
dead_host	192.168.56.102:49203
dead_host	192.168.56.102:49183
dead_host	192.168.56.102:49194
dead_host	192.168.56.102:49174
dead_host	192.168.56.102:49198
dead_host	192.168.56.102:49178
dead_host	192.168.56.102:49185
dead_host	192.168.56.102:49165
dead_host	192.168.56.102:49202
dead_host	192.168.56.102:49182
dead_host	192.168.56.102:49189
dead_host	192.168.56.102:49193
dead_host	192.168.56.102:49173
dead_host	192.168.56.102:49184
dead_host	192.168.56.102:49164
dead_host	192.168.56.102:49197
dead_host	192.168.56.102:49177
dead_host	192.168.56.102:49188
dead_host	185.186.142.55:10425
dead_host	192.168.56.102:49168
dead_host	192.168.56.102:49201
dead_host	192.168.56.102:49163
dead_host	192.168.56.102:49181
dead_host	192.168.56.102:49192

babkaaepta.exe

Process Tree Toggle all

Network Toggle all

Suricata Toggle all

Suricata Alerts

Suricata TLS

Signatures Toggle All