Favorites
Tools
Dr.Zero Chatbot
Notifications
Guide 2020-06-10
Version history 2020-06-10

Summary | ZeroBOX

.svchost.exe

Generic Malware Malicious Packer UPX PE32 PE File

Category	Machine	Started	Completed
FILE	s1_win7_x6401	Aug. 4, 2021, 5:03 p.m.	Aug. 4, 2021, 5:05 p.m.

Size	261.1KB
Type	PE32 executable (GUI) Intel 80386, for MS Windows
MD5	`177cda5816d2c89f89a888d821b7cfdc`
SHA256	`0d9b27baeb38f29add3246d1e1a58bd197269176f0a7a79f062efbc21b0ccf6d`
CRC32	`99D86F49`
ssdeep	`1536:taUdNqn30JarWf4YPubvlMiH0giPHfUHT6WW5jUqFSAapUf4y:Js3SmKimPHfg/3gv`
Yara	Malicious_Packer_Zero - Malicious Packer PE_Header_Zero - PE File Signature Generic_Malware_Zero - Generic Malware UPX_Zero - UPX packed file IsPE32 - (no description)

.svchost.exe "C:\Users\test22\AppData\Local\Temp\.svchost.exe"
872

Name	Response	Post-Analysis Lookup
No hosts contacted.

IP Address	Status	Action
164.124.101.2	Active	Moloch

Suricata Alerts

No Suricata Alerts

Suricata TLS

No Suricata TLS

Allocates read-write-execute memory (usually to unpack itself) (2 events)

Time & API	Arguments	Status	Return	Repeated
NtProtectVirtualMemory Aug. 4, 2021, 5:03 p.m.	process_identifier: 872 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x72d72000 process_handle: 0xffffffff	1	0	0
NtAllocateVirtualMemory Aug. 4, 2021, 5:03 p.m.	process_identifier: 872 region_size: 57344 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00490000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1	0	0

Foreign language identified in PE resource (1 event)

name

RT_VERSION

language

LANG_CHINESE

filetype

data

sublanguage

SUBLANG_CHINESE_TRADITIONAL

offset

0x00038300

size

0x00000314

File has been identified by 8 AntiVirus engines on VirusTotal as malicious (8 events)

Elastic	malicious (high confidence)
Cylance	Unsafe
Sangfor	Trojan.Win32.Save.a
BitDefenderTheta	Gen:NN.ZevbaF.34058.qm1@amSSyYob
APEX	Malicious
Cynet	Malicious (score: 100)
SentinelOne	Static AI - Suspicious PE
CrowdStrike	win/malicious_confidence_70% (W)

Changes read-write memory protection to read-execute (probably to avoid detection when setting all RWX flags at the same time) (1 event)

Time & API	Arguments	Status	Return	Repeated
NtProtectVirtualMemory Aug. 4, 2021, 5:03 p.m.	process_identifier: 872 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 length: 24576 protection: 32 (PAGE_EXECUTE_READ) base_address: 0x00440000 process_handle: 0xffffffff	1	0	0