Favorites
Tools
Dr.Zero Chatbot
Notifications
Guide 2020-06-10
Version history 2020-06-10

Summary | ZeroBOX

ERFORDERLICH.exe

Generic Malware PE32 PE File .NET EXE

Category	Machine	Started	Completed
FILE	s1_win7_x6403_us	Aug. 5, 2021, 10:55 a.m.	Aug. 5, 2021, 10:57 a.m.

Size	41.5KB
Type	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
MD5	`a707637624c53b312b0300f16ff41f73`
SHA256	`c601685ac7f14ebbfb70be2588c462489b5cf3e8b0eebea87af6ada1356f9330`
CRC32	`9427A038`
ssdeep	`768:JTISj0zZWX4JqbMtRCnFxemi2khCR4+NCM+cnxnXVi4q8UUpn3dbGV5z3Hn:JMwkhCR4+pJA40Upn3dbG7L`
PDB Path	C:\Users\APPLE\AppData\Roaming\3\obj\Debug\TEl Rehber.pdb
Yara	PE_Header_Zero - PE File Signature Generic_Malware_Zero - Generic Malware Is_DotNET_EXE - (no description) IsPE32 - (no description) Win_Backdoor_AsyncRAT_Zero - Win Backdoor AsyncRAT

ERFORDERLICH.exe "C:\Users\test22\AppData\Local\Temp\ERFORDERLICH.exe"
1524

Name	Response	Post-Analysis Lookup
cdn.discordapp.com	A 162.159.135.233 A 162.159.134.233 A 162.159.129.233 A 162.159.130.233 A 162.159.133.233	162.159.129.233

IP Address	Status	Action
162.159.130.233	Active	Moloch
164.124.101.2	Active	Moloch

Suricata Alerts

Flow	SID	Signature	Category
TCP 192.168.56.103:49161 -> 162.159.130.233:443	906200022	SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee)	undefined

Suricata TLS

Flow	Issuer	Subject	Fingerprint
TLS 1.2 192.168.56.103:49161 162.159.130.233:443	C=US, O=Cloudflare, Inc., CN=Cloudflare Inc ECC CA-3	C=US, ST=CA, L=San Francisco, O=Cloudflare, Inc., CN=sni.cloudflaressl.com	54:e1:a7:9d:cc:c8:60:86:f1:a5:da:74:0e:5a:ab:45:df:37:8a:78

Queries for the computername (2 events)

Time & API	Arguments	Status	Return	Repeated
GetComputerNameA Aug. 5, 2021, 10:55 a.m.	computer_name: TEST22-PC	1	1	0
GetComputerNameW Aug. 5, 2021, 10:55 a.m.	computer_name: TEST22-PC	1	1	0

Checks if process is being debugged by a debugger (4 events)

Time & API	Arguments	Status	Return	Repeated
IsDebuggerPresent Aug. 5, 2021, 10:55 a.m.			0	0
IsDebuggerPresent Aug. 5, 2021, 10:55 a.m.			0	0
IsDebuggerPresent Aug. 5, 2021, 10:55 a.m.			0	0
IsDebuggerPresent Aug. 5, 2021, 10:55 a.m.			0	0

This executable has a PDB path (1 event)

pdb_path

C:\Users\APPLE\AppData\Roaming\3\obj\Debug\TEl Rehber.pdb

Checks amount of memory in system, this can be used to detect virtual machines that have a low amount of memory available (1 event)

Time & API	Arguments	Status	Return	Repeated
GlobalMemoryStatusEx Aug. 5, 2021, 10:55 a.m.		1	1	0

One or more potentially interesting buffers were extracted, these generally contain injected code, configuration data, etc.

HTTP traffic contains suspicious features which may be indicative of malware related traffic (2 events)

suspicious_features	GET method with no useragent header				suspicious_request	GET https://cdn.discordapp.com/attachments/866595431462993932/872311226670153769/nxj.exe
suspicious_features	GET method with no useragent header				suspicious_request	GET https://cdn.discordapp.com/attachments/859130004898447360/871143663751823370/Anasayfa.dll

Performs some HTTP requests (2 events)

request	GET https://cdn.discordapp.com/attachments/866595431462993932/872311226670153769/nxj.exe
request	GET https://cdn.discordapp.com/attachments/859130004898447360/871143663751823370/Anasayfa.dll

Allocates read-write-execute memory (usually to unpack itself) (18 events)

Time & API	Arguments	Status	Return	Repeated
NtAllocateVirtualMemory Aug. 5, 2021, 10:55 a.m.	process_identifier: 1524 region_size: 1900544 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x006d0000 allocation_type: 8192 (MEM_RESERVE) process_handle: 0xffffffff	1	0	0
NtAllocateVirtualMemory Aug. 5, 2021, 10:55 a.m.	process_identifier: 1524 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00860000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1	0	0
NtProtectVirtualMemory Aug. 5, 2021, 10:55 a.m.	process_identifier: 1524 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x73df1000 process_handle: 0xffffffff	1	0	0
NtProtectVirtualMemory Aug. 5, 2021, 10:55 a.m.	process_identifier: 1524 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x73df2000 process_handle: 0xffffffff	1	0	0
NtAllocateVirtualMemory Aug. 5, 2021, 10:55 a.m.	process_identifier: 1524 region_size: 1376256 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x01fd0000 allocation_type: 8192 (MEM_RESERVE) process_handle: 0xffffffff	1	0	0
NtAllocateVirtualMemory Aug. 5, 2021, 10:55 a.m.	process_identifier: 1524 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x020e0000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1	0	0
NtAllocateVirtualMemory Aug. 5, 2021, 10:55 a.m.	process_identifier: 1524 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00432000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1	0	0
NtAllocateVirtualMemory Aug. 5, 2021, 10:55 a.m.	process_identifier: 1524 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00465000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1	0	0
NtAllocateVirtualMemory Aug. 5, 2021, 10:55 a.m.	process_identifier: 1524 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0046b000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1	0	0
NtAllocateVirtualMemory Aug. 5, 2021, 10:55 a.m.	process_identifier: 1524 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00467000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1	0	0
NtAllocateVirtualMemory Aug. 5, 2021, 10:55 a.m.	process_identifier: 1524 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0044c000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1	0	0
NtAllocateVirtualMemory Aug. 5, 2021, 10:55 a.m.	process_identifier: 1524 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00670000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1	0	0
NtAllocateVirtualMemory Aug. 5, 2021, 10:55 a.m.	process_identifier: 1524 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0043a000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1	0	0
NtAllocateVirtualMemory Aug. 5, 2021, 10:55 a.m.	process_identifier: 1524 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0045a000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1	0	0
NtAllocateVirtualMemory Aug. 5, 2021, 10:55 a.m.	process_identifier: 1524 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00457000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1	0	0
NtAllocateVirtualMemory Aug. 5, 2021, 10:55 a.m.	process_identifier: 1524 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00456000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1	0	0
NtAllocateVirtualMemory Aug. 5, 2021, 10:55 a.m.	process_identifier: 1524 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0045b000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1	0	0
NtAllocateVirtualMemory Aug. 5, 2021, 10:55 a.m.	process_identifier: 1524 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0044a000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1	0	0

Checks adapter addresses which can be used to detect virtual network interfaces (1 event)

Time & API	Arguments	Status	Return	Repeated
GetAdaptersAddresses Aug. 5, 2021, 10:55 a.m.	flags: 15 family: 0		111	0

File has been identified by 19 AntiVirus engines on VirusTotal as malicious (19 events)

FireEye	Trojan.GenericKD.37345868
McAfee	Artemis!A707637624C5
Cylance	Unsafe
Cyren	W32/MSIL_Troj.BHP.gen!Eldorado
Symantec	ML.Attribute.HighConfidence
ESET-NOD32	a variant of MSIL/TrojanDownloader.Agent.IMJ
APEX	Malicious
Paloalto	generic.ml
Kaspersky	HEUR:Trojan.MSIL.Gorgon.gen
BitDefender	Trojan.GenericKD.37345868
McAfee-GW-Edition	Artemis!Trojan
Ikarus	Trojan.Inject
MaxSecure	Trojan.Malware.300983.susgen
Kingsoft	Win32.Troj.Undef.(kcloud)
Microsoft	Backdoor:Win32/Bladabindi!ml
Malwarebytes	Spyware.DiscordStealer.Generic
Fortinet	Malicious_Behavior.SB
Webroot	W32.Trojan.Gen
Panda	Trj/RnkBend.A