Summary | ZeroBOX

Category	Machine	Started	Completed
FILE	s1_win7_x6403_us	Aug. 15, 2021, 12:15 p.m.	Aug. 15, 2021, 12:17 p.m.

Size	6.3MB
Type	PE32 executable (GUI) Intel 80386 (stripped to external PDB), for MS Windows
MD5	`0e78df69265dc57c37673bdee540ce2f`
SHA256	`6b74dc043f9a12823ed98d704e4c8543c9b5d8b9240e65e9d31d2303ab914906`
CRC32	`C39262A3`
ssdeep	`196608:zfija2TcwZTDVO2Z6+CTV69Vd8hhWTGPr4uDt7T:GDOMCTQ4hhuE4uDxT`
Yara	PE_Header_Zero - PE File Signature VMProtect_Zero - VMProtect packed file UPX_Zero - UPX packed file Malicious_Library_Zero - Malicious_Library IsPE32 - (no description)

Get-Variable.exe "C:\Users\test22\AppData\Local\Temp\Get-Variable.exe"
1616
- schtasks.exe /create /tn COMSurrogate /st 00:00 /du 9999:59 /sc once /ri 1 /f /tr "C:\Users\test22\Documents\WindowsPowerShell\dllhost.exe"
  2580
- dllhost.exe "C:\Users\test22\Documents\WindowsPowerShell\dllhost.exe"
  200

Name	Response	Post-Analysis Lookup
No hosts contacted.

IP Address	Status	Action
94.103.80.169	Active	Moloch

Suricata Alerts

Flow	SID	Signature	Category
TCP 192.168.56.103:49173 -> 94.103.80.169:80	2017930	ET MALWARE Trojan Generic - POST To gate.php with no referer	A Network Trojan was detected
TCP 192.168.56.103:49173 -> 94.103.80.169:80	2022985	ET MALWARE Trojan Generic - POST To gate.php with no accept headers	A Network Trojan was detected
TCP 192.168.56.103:49172 -> 94.103.80.169:80	2017930	ET MALWARE Trojan Generic - POST To gate.php with no referer	A Network Trojan was detected
TCP 192.168.56.103:49173 -> 94.103.80.169:80	2022986	ET MALWARE Likely Zbot Generic Request to gate.php Dotted-Quad	A Network Trojan was detected
TCP 192.168.56.103:49172 -> 94.103.80.169:80	2022985	ET MALWARE Trojan Generic - POST To gate.php with no accept headers	A Network Trojan was detected
TCP 192.168.56.103:49172 -> 94.103.80.169:80	2022986	ET MALWARE Likely Zbot Generic Request to gate.php Dotted-Quad	A Network Trojan was detected
TCP 192.168.56.103:49168 -> 94.103.80.169:80	2022818	ET MALWARE Generic gate[.].php GET with minimal headers	A Network Trojan was detected
TCP 192.168.56.103:49171 -> 94.103.80.169:80	2022818	ET MALWARE Generic gate[.].php GET with minimal headers	A Network Trojan was detected
TCP 192.168.56.103:49168 -> 94.103.80.169:80	2022986	ET MALWARE Likely Zbot Generic Request to gate.php Dotted-Quad	A Network Trojan was detected
TCP 192.168.56.103:49171 -> 94.103.80.169:80	2022986	ET MALWARE Likely Zbot Generic Request to gate.php Dotted-Quad	A Network Trojan was detected
TCP 192.168.56.103:49168 -> 94.103.80.169:80	2030802	ET HUNTING Suspicious GET To gate.php with no Referer	Potentially Bad Traffic
TCP 192.168.56.103:49171 -> 94.103.80.169:80	2030802	ET HUNTING Suspicious GET To gate.php with no Referer	Potentially Bad Traffic
TCP 192.168.56.103:49174 -> 94.103.80.169:80	2017930	ET MALWARE Trojan Generic - POST To gate.php with no referer	A Network Trojan was detected
TCP 192.168.56.103:49174 -> 94.103.80.169:80	2022985	ET MALWARE Trojan Generic - POST To gate.php with no accept headers	A Network Trojan was detected
TCP 192.168.56.103:49174 -> 94.103.80.169:80	2022986	ET MALWARE Likely Zbot Generic Request to gate.php Dotted-Quad	A Network Trojan was detected
TCP 192.168.56.103:49171 -> 94.103.80.169:80	2017930	ET MALWARE Trojan Generic - POST To gate.php with no referer	A Network Trojan was detected
TCP 192.168.56.103:49171 -> 94.103.80.169:80	2020181	ET MALWARE WIN32/KOVTER.B Checkin	Malware Command and Control Activity Detected
TCP 192.168.56.103:49171 -> 94.103.80.169:80	2022985	ET MALWARE Trojan Generic - POST To gate.php with no accept headers	A Network Trojan was detected
TCP 192.168.56.103:49171 -> 94.103.80.169:80	2022986	ET MALWARE Likely Zbot Generic Request to gate.php Dotted-Quad	A Network Trojan was detected
TCP 192.168.56.103:49171 -> 94.103.80.169:80	2017930	ET MALWARE Trojan Generic - POST To gate.php with no referer	A Network Trojan was detected
TCP 192.168.56.103:49171 -> 94.103.80.169:80	2022985	ET MALWARE Trojan Generic - POST To gate.php with no accept headers	A Network Trojan was detected
TCP 192.168.56.103:49171 -> 94.103.80.169:80	2022986	ET MALWARE Likely Zbot Generic Request to gate.php Dotted-Quad	A Network Trojan was detected

Suricata TLS

No Suricata TLS

Queries for the computername (2 events)

Time & API	Arguments	Status	Return	Repeated
GetComputerNameW Aug. 15, 2021, 12:15 p.m.	computer_name: TEST22-PC	1	1	0
GetComputerNameW Aug. 15, 2021, 12:15 p.m.	computer_name: TEST22-PC	1	1	0

Checks if process is being debugged by a debugger (2 events)

Time & API	Arguments	Status	Return	Repeated
IsDebuggerPresent Aug. 15, 2021, 12:15 p.m.			0	0
IsDebuggerPresent Aug. 15, 2021, 12:15 p.m.			0	0

The executable contains unknown PE section names indicative of a packer (could be a false positive) (2 events)

section	.vmp0
section	.vmp1

HTTP traffic contains suspicious features which may be indicative of malware related traffic (3 events)

suspicious_features	Connection to IP address	suspicious_request	GET http://94.103.80.169/gate.php?type=check&uid=14F63AB901393115137325
suspicious_features	POST method with no referer header, Connection to IP address	suspicious_request	POST http://94.103.80.169/gate.php?type=update&uid=14F63AB901393115137325
suspicious_features	POST method with no referer header, Connection to IP address	suspicious_request	POST http://94.103.80.169/gate.php?type=ping&uid=14F63AB901393115137325

Performs some HTTP requests (3 events)

request	GET http://94.103.80.169/gate.php?type=check&uid=14F63AB901393115137325
request	POST http://94.103.80.169/gate.php?type=update&uid=14F63AB901393115137325
request	POST http://94.103.80.169/gate.php?type=ping&uid=14F63AB901393115137325

Sends data using the HTTP POST Method (2 events)

request	POST http://94.103.80.169/gate.php?type=update&uid=14F63AB901393115137325
request	POST http://94.103.80.169/gate.php?type=ping&uid=14F63AB901393115137325

Allocates read-write-execute memory (usually to unpack itself) (4 events)

Time & API	Arguments	Status
NtAllocateVirtualMemory Aug. 15, 2021, 12:15 p.m.	process_identifier: 1616 region_size: 28672 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x01700000 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0xffffffff	1
NtProtectVirtualMemory Aug. 15, 2021, 12:15 p.m.	process_identifier: 1616 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 length: 20480 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x01701000 process_handle: 0xffffffff	1
NtAllocateVirtualMemory Aug. 15, 2021, 12:15 p.m.	process_identifier: 200 region_size: 28672 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x03190000 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0xffffffff	1
NtProtectVirtualMemory Aug. 15, 2021, 12:15 p.m.	process_identifier: 200 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 length: 20480 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x03191000 process_handle: 0xffffffff	1

Creates a suspicious process (2 events)

cmdline	/create /tn COMSurrogate /st 00:00 /du 9999:59 /sc once /ri 1 /f /tr "C:\Users\test22\Documents\WindowsPowerShell\dllhost.exe"
cmdline	C:\Users\test22\Documents\WindowsPowerShell\dllhost.exe

The binary likely contains encrypted or compressed data indicative of a packer (3 events)

section

{u'size_of_data': u'0x00638a00', u'virtual_address': u'0x00ba7000', u'entropy': 7.967156058446666, u'name': u'.vmp1', u'virtual_size': u'0x006389f0'}

entropy

7.96715605845

description

A section with a high entropy has been found

section

{u'size_of_data': u'0x00010e00', u'virtual_address': u'0x011e0000', u'entropy': 7.510244933064441, u'name': u'.rsrc', u'virtual_size': u'0x00010c2a'}

entropy

7.51024493306

description

A section with a high entropy has been found

entropy

1.0

description

Overall entropy of this PE file is high

Uses Windows utilities for basic Windows functionality (1 event)

cmdline

/create /tn COMSurrogate /st 00:00 /du 9999:59 /sc once /ri 1 /f /tr "C:\Users\test22\Documents\WindowsPowerShell\dllhost.exe"

The executable is likely packed with VMProtect (2 events)

section	.vmp0				description	Section name indicates VMProtect
section	.vmp1				description	Section name indicates VMProtect

Communicates with host for which no DNS query was performed (1 event)

host

94.103.80.169

Attempts to remove evidence of file being downloaded from the Internet (1 event)

file	C:\Users\test22\Documents\WindowsPowerShell\dllhost.exe:Zone.Identifier

Uses Sysinternals tools in order to add additional command line functionality (1 event)

cmdline

/create /tn COMSurrogate /st 00:00 /du 9999:59 /sc once /ri 1 /f /tr "C:\Users\test22\Documents\WindowsPowerShell\dllhost.exe"

File has been identified by 23 AntiVirus engines on VirusTotal as malicious (23 events)

Lionic	Trojan.Win32.Generic.4!c
Elastic	malicious (high confidence)
McAfee	Artemis!0E78DF69265D
Cylance	Unsafe
Sangfor	Riskware.Win32.Wacapew.C
Cybereason	malicious.8b5fca
BitDefenderTheta	Gen:NN.ZexaF.34058.@VX@aaTg2Vm
Symantec	ML.Attribute.HighConfidence
APEX	Malicious
Paloalto	generic.ml
Kaspersky	Trojan-Spy.Win32.SpyEyes.bour
Avast	FileRepMetagen [Malware]
McAfee-GW-Edition	Artemis!Trojan
FireEye	Generic.mg.0e78df69265dc57c
Sophos	Mal/Generic-S
Avira	HEUR/AGEN.1144000
Microsoft	Trojan:Win32/Tnega!ml
Cynet	Malicious (score: 100)
eGambit	PE.Heur.InvalidSig
Fortinet	W32/SpyEyes.BOUR!tr
MaxSecure	Trojan.Malware.300983.susgen
AVG	FileRepMetagen [Malware]
CrowdStrike	win/malicious_confidence_80% (W)

Get-Variable.exe

Process Tree Toggle all

Network Toggle all

Suricata Toggle all

Suricata Alerts

Suricata TLS

Signatures Toggle All