Summary | ZeroBOX

Category	Machine	Started	Completed
FILE	s1_win7_x6401	Aug. 5, 2021, 10:14 a.m.	Aug. 5, 2021, 10:23 a.m.

Size	3.2MB
Type	PE32 executable (GUI) Intel 80386, for MS Windows
MD5	`106b947aa2e8101bff6e3ff0f82bfe95`
SHA256	`88689636f4b2287701b63f42c12e7e2387bf4c3ecc45eeb8a61ea707126bad9b`
CRC32	`4D594917`
ssdeep	`49152:yNUPRS5YfeBi35enfGiSpQQ17dWRsnVQLKaCTpdNu:d/+I7mwFTpf`
Yara	Malicious_Packer_Zero - Malicious Packer PE_Header_Zero - PE File Signature OS_Processor_Check_Zero - OS Processor Check Generic_Malware_Zero - Generic Malware UPX_Zero - UPX packed file IsPE32 - (no description) Malicious_Library_Zero - Malicious_Library

nympholepsies.exe "C:\Users\test22\AppData\Local\Temp\nympholepsies.exe"
2164
- secinit.exe "C:\Windows\System32\secinit.exe"
  1164

Name	Response	Post-Analysis Lookup
No hosts contacted.

IP Address	Status	Action
No hosts contacted.

Suricata Alerts

No Suricata Alerts

Suricata TLS

No Suricata TLS

One or more potentially interesting buffers were extracted, these generally contain injected code, configuration data, etc.

Allocates read-write-execute memory (usually to unpack itself) (1 event)

Time & API	Arguments	Status	Return	Repeated
NtAllocateVirtualMemory Aug. 5, 2021, 10:15 a.m.	process_identifier: 2164 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00550000 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0xffffffff	1	0	0

Queries the disk size which could be used to detect virtual machine with small fixed size or dynamic allocation (4 events)

Time & API	Arguments	Status	Return
GetDiskFreeSpaceW Aug. 5, 2021, 10:15 a.m.	number_of_free_clusters: 3350730 sectors_per_cluster: 8 bytes_per_sector: 512 root_path: c:\ total_number_of_clusters: 8362495	1	1
GetDiskFreeSpaceW Aug. 5, 2021, 10:15 a.m.	number_of_free_clusters: 3350730 sectors_per_cluster: 8 bytes_per_sector: 512 root_path: c:\ total_number_of_clusters: 8362495	1	1
GetDiskFreeSpaceW Aug. 5, 2021, 10:15 a.m.	number_of_free_clusters: 0 sectors_per_cluster: 0 bytes_per_sector: 0 root_path: d:\ total_number_of_clusters: 0		0
GetDiskFreeSpaceW Aug. 5, 2021, 10:15 a.m.	number_of_free_clusters: 0 sectors_per_cluster: 0 bytes_per_sector: 0 root_path: d:\ total_number_of_clusters: 0		0

Searches running processes potentially to identify processes for sandbox evasion, code injection or memory dumping (5 events)

Time & API	Arguments	Status	Return
Process32NextW Aug. 5, 2021, 10:15 a.m.	snapshot_handle: 0x00000088 process_name: pw.exe process_identifier: 2892	1	1
Process32NextW Aug. 5, 2021, 10:15 a.m.	snapshot_handle: 0x00000088 process_name: taskhost.exe process_identifier: 1684	1	1
Process32NextW Aug. 5, 2021, 10:15 a.m.	snapshot_handle: 0x00000088 process_name: SearchProtocolHost.exe process_identifier: 2428	1	1
Process32NextW Aug. 5, 2021, 10:15 a.m.	snapshot_handle: 0x00000088 process_name: SearchFilterHost.exe process_identifier: 596	1	1
Process32NextW Aug. 5, 2021, 10:15 a.m.	snapshot_handle: 0x00000088 process_name: secinit.exe process_identifier: 1164	1	1

Potentially malicious URLs were found in the process memory dump (3 events)

url	https://cerionetya.com/src
url	https://github.com/libcala/whoami/issuescalled
url	https://www.catcert.net/verarrel

Yara rule detected in process memory (15 events)

description	Communications use DNS	rule	Network_DNS
description	Communications over RAW Socket	rule	Network_TCP_Socket
description	Escalate priviledges	rule	Escalate_priviledges
description	(no description)	rule	DebuggerCheck__GlobalFlags
description	(no description)	rule	DebuggerCheck__QueryInfo
description	(no description)	rule	DebuggerHiding__Thread
description	(no description)	rule	DebuggerHiding__Active
description	(no description)	rule	ThreadControl__Context
description	(no description)	rule	SEH__vectored
description	Possibly employs anti-virtualization techniques	rule	vmdetect
description	Checks if being debugged	rule	anti_dbg
description	Anti-Sandbox checks for ThreatExpert	rule	antisb_threatExpert
description	AntiVM checks for VirtualBox	rule	antivm_virtualbox
description	Bypass DEP	rule	disable_dep
description	Following Rule is referenced from AlienVault's Yara rule repository.This rule contains additional processes and driver names.	rule	vmdetect_misc

Allocates execute permission to another process indicative of possible code injection (1 event)

Time & API	Arguments	Status	Return	Repeated
NtAllocateVirtualMemory Aug. 5, 2021, 10:15 a.m.	process_identifier: 1164 region_size: 1261568 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00400000 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0x00000078	1	0	0

Potential code injection by writing to the memory of another process (3 events)

Time & API	Arguments	Status	Return
WriteProcessMemory Aug. 5, 2021, 10:15 a.m.	buffer: MZÿÿ¸@øº´ Í!¸LÍ!This program cannot be run in DOS mode. $ßBAt#/'#/'#/'ÀK,&#/'ÀK&#/'ÀK+&#/'%R&½#/'%R+&#/'%R,&#/'ÀK.&#/'#.'#/'Q+&#/'#/'#/'Q-&#/'Rich#/'PELÊF aà"n ¬ ä @@@ °è\|{\|{@ .textÄm n `.rdataô r @@.data$ @À.relocè°@B base_address: 0x00400000 process_identifier: 1164 process_handle: 0x00000078	1	1
WriteProcessMemory Aug. 5, 2021, 10:15 a.m.	buffer: k±A°oE`EpEÿÿÿÿàêEvèF }Au±¿DNæ@»ÿÿÿÿÿÿÿÿ ÿÿÿÿ abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ¤`y!¦ß¡¥àü@~ü¨Á£Ú£ þ@þµÁ£Ú£ þAþ¶Ï¢ä¢å¢è¢[þ@~¡þQQÚ^Ú _ÚjÚ2ÓØÞàù1~þHDR R R R R R¨RÈFRHHR>RàRÀRCøR¸£R¸£R¸£R¸£R¸£R¸£R¸£R¸£R¸£RüR¼£R¼£R¼£R¼£R¼£R¼£R¼£R..þÿÿÿ $þÿÿÿ base_address: 0x00529000 process_identifier: 1164 process_handle: 0x00000078	1	1
WriteProcessMemory Aug. 5, 2021, 10:15 a.m.	buffer: @ base_address: 0x7efde008 process_identifier: 1164 process_handle: 0x00000078	1	1

Code injection by writing an executable or DLL to the memory of another process (1 event)

Time & API	Arguments	Status	Return	Repeated
WriteProcessMemory Aug. 5, 2021, 10:15 a.m.	buffer: MZÿÿ¸@øº´ Í!¸LÍ!This program cannot be run in DOS mode. $ßBAt#/'#/'#/'ÀK,&#/'ÀK&#/'ÀK+&#/'%R&½#/'%R+&#/'%R,&#/'ÀK.&#/'#.'#/'Q+&#/'#/'#/'Q-&#/'Rich#/'PELÊF aà"n ¬ ä @@@ °è\|{\|{@ .textÄm n `.rdataô r @@.data$ @À.relocè°@B base_address: 0x00400000 process_identifier: 1164 process_handle: 0x00000078	1	1	0

Used NtSetContextThread to modify a thread in a remote process indicative of process injection (2 events)

Time & API	Arguments	Status	Return	Repeated
Process injection	Process 2164 called NtSetContextThread to modify thread in remote process 1164
NtSetContextThread Aug. 5, 2021, 10:15 a.m.	registers.eip: 2000355780 registers.esp: 2030952 registers.edi: 0 registers.eax: 4755172 registers.ebp: 0 registers.edx: 0 registers.ebx: 2130567168 registers.esi: 0 registers.ecx: 0 thread_handle: 0x00000074 process_identifier: 1164	1	0	0

Resumed a suspended thread in a remote process potentially indicative of process injection (2 events)

Time & API	Arguments	Status	Return	Repeated
Process injection	Process 2164 resumed a thread in remote process 1164
NtResumeThread Aug. 5, 2021, 10:15 a.m.	thread_handle: 0x00000074 suspend_count: 1 process_identifier: 1164	1	0	0

Executed a process and injected code into it, probably while unpacking (11 events)

Time & API	Arguments	Status	Return
CreateProcessInternalW Aug. 5, 2021, 10:15 a.m.	thread_identifier: 3036 thread_handle: 0x00000074 process_identifier: 1164 current_directory: C:\Windows\System32\ filepath: C:\Windows\System32\secinit.exe track: 1 command_line: filepath_r: C:\Windows\System32\secinit.exe stack_pivoted: 0 creation_flags: 4 (CREATE_SUSPENDED) inherit_handles: 0 process_handle: 0x00000078	1	1
NtGetContextThread Aug. 5, 2021, 10:15 a.m.	thread_handle: 0x00000074	1	0
NtAllocateVirtualMemory Aug. 5, 2021, 10:15 a.m.	process_identifier: 1164 region_size: 1261568 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00400000 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0x00000078	1	0
WriteProcessMemory Aug. 5, 2021, 10:15 a.m.	buffer: MZÿÿ¸@øº´ Í!¸LÍ!This program cannot be run in DOS mode. $ßBAt#/'#/'#/'ÀK,&#/'ÀK&#/'ÀK+&#/'%R&½#/'%R+&#/'%R,&#/'ÀK.&#/'#.'#/'Q+&#/'#/'#/'Q-&#/'Rich#/'PELÊF aà"n ¬ ä @@@ °è\|{\|{@ .textÄm n `.rdataô r @@.data$ @À.relocè°@B base_address: 0x00400000 process_identifier: 1164 process_handle: 0x00000078	1	1
WriteProcessMemory Aug. 5, 2021, 10:15 a.m.	buffer: base_address: 0x00401000 process_identifier: 1164 process_handle: 0x00000078	1	1
WriteProcessMemory Aug. 5, 2021, 10:15 a.m.	buffer: base_address: 0x00498000 process_identifier: 1164 process_handle: 0x00000078	1	1
WriteProcessMemory Aug. 5, 2021, 10:15 a.m.	buffer: k±A°oE`EpEÿÿÿÿàêEvèF }Au±¿DNæ@»ÿÿÿÿÿÿÿÿ ÿÿÿÿ abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ¤`y!¦ß¡¥àü@~ü¨Á£Ú£ þ@þµÁ£Ú£ þAþ¶Ï¢ä¢å¢è¢[þ@~¡þQQÚ^Ú _ÚjÚ2ÓØÞàù1~þHDR R R R R R¨RÈFRHHR>RàRÀRCøR¸£R¸£R¸£R¸£R¸£R¸£R¸£R¸£R¸£RüR¼£R¼£R¼£R¼£R¼£R¼£R¼£R..þÿÿÿ $þÿÿÿ base_address: 0x00529000 process_identifier: 1164 process_handle: 0x00000078	1	1
WriteProcessMemory Aug. 5, 2021, 10:15 a.m.	buffer: base_address: 0x0052b000 process_identifier: 1164 process_handle: 0x00000078	1	1
WriteProcessMemory Aug. 5, 2021, 10:15 a.m.	buffer: @ base_address: 0x7efde008 process_identifier: 1164 process_handle: 0x00000078	1	1
NtSetContextThread Aug. 5, 2021, 10:15 a.m.	registers.eip: 2000355780 registers.esp: 2030952 registers.edi: 0 registers.eax: 4755172 registers.ebp: 0 registers.edx: 0 registers.ebx: 2130567168 registers.esi: 0 registers.ecx: 0 thread_handle: 0x00000074 process_identifier: 1164	1	0
NtResumeThread Aug. 5, 2021, 10:15 a.m.	thread_handle: 0x00000074 suspend_count: 1 process_identifier: 1164	1	0

File has been identified by 35 AntiVirus engines on VirusTotal as malicious (35 events)

Lionic	Trojan.Win32.Zusy.4!c
Cynet	Malicious (score: 100)
ALYac	Gen:Variant.Zusy.395105
Cylance	Unsafe
Sangfor	Trojan.Win32.Save.a
K7AntiVirus	Trojan ( 0057c36a1 )
Alibaba	Trojan:Win32/DropperX.7cc1d080
K7GW	Trojan ( 0057c36a1 )
Arcabit	Trojan.Zusy.D60761
Cyren	W32/Agent.DEL.gen!Eldorado
Symantec	ML.Attribute.HighConfidence
ESET-NOD32	a variant of Win32/Agent.ADBL
APEX	Malicious
Paloalto	generic.ml
BitDefender	Gen:Variant.Zusy.395105
MicroWorld-eScan	Gen:Variant.Zusy.395105
Avast	Win32:DropperX-gen [Drp]
Ad-Aware	Gen:Variant.Zusy.395105
Emsisoft	Gen:Variant.Zusy.395105 (B)
McAfee-GW-Edition	BehavesLike.Win32.Adopshel.wh
FireEye	Generic.mg.106b947aa2e8101b
Sophos	Generic PUA HI (PUA)
Jiangmin	Trojan.Generic.gzxaj
Webroot	W32.Trojan.Gen
MAX	malware (ai score=86)
Microsoft	Trojan:Win32/Woreflint.A!cl
GData	Gen:Variant.Zusy.395105
AhnLab-V3	Dropper/Win.Generic.C4578283
McAfee	Artemis!106B947AA2E8
TrendMicro-HouseCall	TROJ_GEN.R002H0CH321
Ikarus	Trojan.Win32.Agent
Fortinet	W32/Agent.ADBL!tr
BitDefenderTheta	Gen:NN.ZexaF.34058.jtW@au@OqQk
AVG	Win32:DropperX-gen [Drp]
Qihoo-360	Win32/TrojanDropper.Generic.HgIASZsA

nympholepsies

Process Tree Toggle all

Network Toggle all

Suricata Toggle all

Suricata Alerts

Suricata TLS

Signatures Toggle All