Favorites
Tools
Dr.Zero Chatbot
Notifications
Guide 2020-06-10
Version history 2020-06-10

Summary | ZeroBOX

81vy8extract.exe

Gen1 Generic Malware UPX Malicious Library PE File OS Processor Check PE32 .NET EXE

Category	Machine	Started	Completed
FILE	s1_win7_x6402	Aug. 6, 2021, 4:38 p.m.	Aug. 6, 2021, 4:42 p.m.

Size	1.1MB
Type	PE32 executable (console) Intel 80386 Mono/.Net assembly, for MS Windows
MD5	`902bf3ec932ad1d22584f7c30c35f65e`
SHA256	`13079f66ab8a1561e3c46fbcd0fcb6d46a75efb5e51986a1468aac2401e931fb`
CRC32	`B48D1C9F`
ssdeep	`12288:Fl3PtsG4saYxGrTwyRUkHBs7POsB1iXh1p8QUuEnf9Tg4IpJ:Flfn4saYxETwyikHmWsGp81uCO`
PDB Path	C:\Users\black\Desktop\New folder (4)\extract\obj\Debug\extract.pdb
Yara	UPX_Zero - UPX packed file Win32_Trojan_Gen_2_0904B0_Zero - Win32 Trojan Gen OS_Processor_Check_Zero - OS Processor Check Generic_Malware_Zero - Generic Malware Is_DotNET_EXE - (no description) Malicious_Library_Zero - Malicious_Library PE_Header_Zero - PE File Signature IsPE32 - (no description) Win_Backdoor_AsyncRAT_Zero - Win Backdoor AsyncRAT Win32_Trojan_Gen_1_0904B0_Zero - Win32 Trojan Emotet

81vy8extract.exe "C:\Users\test22\AppData\Local\Temp\81vy8extract.exe"
2052
- cmd.exe "cmd.exe"
  2188

Name	Response	Post-Analysis Lookup
No hosts contacted.

IP Address	Status	Action
No hosts contacted.

Suricata Alerts

No Suricata Alerts

Suricata TLS

No Suricata TLS

Queries for the computername (2 events)

Time & API	Arguments	Status	Return	Repeated
GetComputerNameA Aug. 6, 2021, 4:38 p.m.	computer_name: TEST22-PC	1	1	0
GetComputerNameW Aug. 6, 2021, 4:38 p.m.	computer_name: TEST22-PC	1	1	0

Checks if process is being debugged by a debugger (4 events)

Time & API	Arguments	Status	Return	Repeated
IsDebuggerPresent Aug. 6, 2021, 4:38 p.m.			0	0
IsDebuggerPresent Aug. 6, 2021, 4:38 p.m.			0	0
IsDebuggerPresent Aug. 6, 2021, 4:38 p.m.			0	0
IsDebuggerPresent Aug. 6, 2021, 4:38 p.m.			0	0

Command line console output was observed (5 events)

Time & API	Arguments	Status	Return	Repeated
WriteConsoleA Aug. 6, 2021, 4:38 p.m.	buffer: C:\Windows \System32\ console_handle: 0x00000007	1	1	0
WriteConsoleA Aug. 6, 2021, 4:38 p.m.	buffer: System.UnauthorizedAccessException: 'C:\Windows\System32\VERSION.dll' ??? ?? ???? ???????. ??: System.IO.__Error.WinIOError(Int32 errorCode, String maybeFullPath) ??: System.IO.FileStream.Init(String path, FileMode mode, FileAccess access, Int32 rights, Boolean useRights, FileShare share, Int32 bufferSize, FileOptions options, SECURITY_ATTRIBUTES secAttrs, String msgPath, Boolean bFromProxy, Boolean useLongPath, Boolean checkHost) ??: System.IO.FileStream..ctor(String path, FileMode mode, FileAccess access, FileShare share) ??: System.IO.File.OpenWrite(String path) ??: extract.Program.extractResource(String embeddedFileName, String destinationPath) ??: extract.Program.Main(String[] args) console_handle: 0x0000000b	1	1	0
WriteConsoleW Aug. 6, 2021, 4:38 p.m.	buffer: The filename, directory name, or volume label syntax is incorrect. console_handle: 0x0000000b	1	1	0
WriteConsoleW Aug. 6, 2021, 4:38 p.m.	buffer: The process tried to write to a nonexistent pipe. console_handle: 0x0000000b	1	1	0
WriteConsoleW Aug. 6, 2021, 4:38 p.m.	buffer: The process tried to write to a nonexistent pipe. console_handle: 0x0000000b	1	1	0

This executable has a PDB path (1 event)

pdb_path

C:\Users\black\Desktop\New folder (4)\extract\obj\Debug\extract.pdb

Checks amount of memory in system, this can be used to detect virtual machines that have a low amount of memory available (1 event)

Time & API	Arguments	Status	Return	Repeated
GlobalMemoryStatusEx Aug. 6, 2021, 4:38 p.m.		1	1	0

Allocates read-write-execute memory (usually to unpack itself) (16 events)

Time & API	Arguments	Status	Return	Repeated
NtAllocateVirtualMemory Aug. 6, 2021, 4:38 p.m.	process_identifier: 2052 region_size: 1376256 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00730000 allocation_type: 8192 (MEM_RESERVE) process_handle: 0xffffffff	1	0	0
NtAllocateVirtualMemory Aug. 6, 2021, 4:38 p.m.	process_identifier: 2052 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00840000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1	0	0
NtProtectVirtualMemory Aug. 6, 2021, 4:38 p.m.	process_identifier: 2052 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x73a71000 process_handle: 0xffffffff	1	0	0
NtProtectVirtualMemory Aug. 6, 2021, 4:38 p.m.	process_identifier: 2052 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x73a72000 process_handle: 0xffffffff	1	0	0
NtAllocateVirtualMemory Aug. 6, 2021, 4:38 p.m.	process_identifier: 2052 region_size: 917504 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x005d0000 allocation_type: 8192 (MEM_RESERVE) process_handle: 0xffffffff	1	0	0
NtAllocateVirtualMemory Aug. 6, 2021, 4:38 p.m.	process_identifier: 2052 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00670000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1	0	0
NtAllocateVirtualMemory Aug. 6, 2021, 4:38 p.m.	process_identifier: 2052 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00532000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1	0	0
NtAllocateVirtualMemory Aug. 6, 2021, 4:38 p.m.	process_identifier: 2052 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00565000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1	0	0
NtAllocateVirtualMemory Aug. 6, 2021, 4:38 p.m.	process_identifier: 2052 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0056b000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1	0	0
NtAllocateVirtualMemory Aug. 6, 2021, 4:38 p.m.	process_identifier: 2052 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00567000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1	0	0
NtAllocateVirtualMemory Aug. 6, 2021, 4:38 p.m.	process_identifier: 2052 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0054c000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1	0	0
NtAllocateVirtualMemory Aug. 6, 2021, 4:38 p.m.	process_identifier: 2052 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00640000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1	0	0
NtAllocateVirtualMemory Aug. 6, 2021, 4:38 p.m.	process_identifier: 2052 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0053a000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1	0	0
NtAllocateVirtualMemory Aug. 6, 2021, 4:38 p.m.	process_identifier: 2052 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00556000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1	0	0
NtAllocateVirtualMemory Aug. 6, 2021, 4:38 p.m.	process_identifier: 2052 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0055a000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1	0	0
NtAllocateVirtualMemory Aug. 6, 2021, 4:38 p.m.	process_identifier: 2052 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00557000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1	0	0

Creates a suspicious process (1 event)

cmdline

"cmd.exe"

A process created a hidden window (1 event)

Time & API	Arguments	Status	Return	Repeated
CreateProcessInternalW Aug. 6, 2021, 4:38 p.m.	thread_identifier: 2192 thread_handle: 0x000001f4 process_identifier: 2188 current_directory: C:\Users\test22\AppData\Local\Temp filepath: track: 1 command_line: "cmd.exe" filepath_r: stack_pivoted: 0 creation_flags: 134217728 (CREATE_NO_WINDOW) inherit_handles: 1 process_handle: 0x00000204	1	1	0

File has been identified by 13 AntiVirus engines on VirusTotal as malicious (13 events)

FireEye	Generic.mg.902bf3ec932ad1d2
McAfee	Artemis!902BF3EC932A
Sangfor	Trojan.Win32.Save.a
Cybereason	malicious.91b5fa
APEX	Malicious
Avast	FileRepMalware
McAfee-GW-Edition	Artemis!Trojan
Sophos	Mal/Generic-R
SentinelOne	Static AI - Suspicious PE
Microsoft	Program:Win32/Wacapew.C!ml
BitDefenderTheta	Gen:NN.ZemsilF.34058.fn0@aeINbaj
AVG	FileRepMalware
Qihoo-360	Win32/Heur.Generic.HwMAueAA