Summary | ZeroBOX

Category	Machine	Started	Completed
FILE	s1_win7_x6402	Aug. 29, 2021, 12:38 p.m.	Aug. 29, 2021, 12:44 p.m.

Size	314.0KB
Type	PE32 executable (GUI) Intel 80386, for MS Windows
MD5	`99d398716a945554c09b46769502d375`
SHA256	`c0103863a7a7aa59b13f4253a2575b02f00f29a53251a13132ba34b1987b8dfa`
CRC32	`1C7264FA`
ssdeep	`6144:OWu3joBbvuSDU09wAoRsO7v5fVxafPKeBl8SmdscSy:O3q7uSDTwAqpDZrGc9LSy`
PDB Path	C:\vos.pdb
Yara	PE_Header_Zero - PE File Signature OS_Processor_Check_Zero - OS Processor Check Malicious_Library_Zero - Malicious_Library IsPE32 - (no description)

imcr.exe "C:\Users\test22\AppData\Local\Temp\imcr.exe"
304
- imcr.exe "C:\Users\test22\AppData\Local\Temp\imcr.exe"
  2236

Name	Response	Post-Analysis Lookup
smart.cloudnetwork.kz	A 37.1.207.157	37.1.207.157
secure.jsc0nten1maker.com	A 63.251.126.11	63.251.126.11
static.apiinformationsec.com	A 63.251.106.25	63.251.106.25
tel.jsapisettings.kz
secure.jscontentmaker.kz
noone.contentmakersbyakamai.ru	A 208.100.26.245	208.100.26.245
nicru.supermicrotransapi.ru
static.apiinformation.kz
mel.cloudcontentsmak.com	A 87.106.18.122	87.106.18.122
js.securetopdevelopment.kz

IP Address	Status	Action
164.124.101.2	Active	Moloch
208.100.26.245	Active	Moloch
37.1.207.157	Active	Moloch
63.251.106.25	Active	Moloch
63.251.126.11	Active	Moloch
87.106.18.122	Active	Moloch

Suricata Alerts

Flow	SID	Signature	Category
TCP 63.251.126.11:80 -> 192.168.56.102:49168	2018141	ET MALWARE Possible Compromised Host AnubisNetworks Sinkhole Cookie Value Snkz	A Network Trojan was detected
TCP 63.251.126.11:80 -> 192.168.56.102:49173	2018141	ET MALWARE Possible Compromised Host AnubisNetworks Sinkhole Cookie Value Snkz	A Network Trojan was detected
TCP 63.251.106.25:80 -> 192.168.56.102:49174	2018141	ET MALWARE Possible Compromised Host AnubisNetworks Sinkhole Cookie Value Snkz	A Network Trojan was detected
TCP 63.251.106.25:80 -> 192.168.56.102:49179	2018141	ET MALWARE Possible Compromised Host AnubisNetworks Sinkhole Cookie Value Snkz	A Network Trojan was detected
TCP 63.251.126.11:80 -> 192.168.56.102:49178	2018141	ET MALWARE Possible Compromised Host AnubisNetworks Sinkhole Cookie Value Snkz	A Network Trojan was detected
TCP 63.251.106.25:80 -> 192.168.56.102:49169	2018141	ET MALWARE Possible Compromised Host AnubisNetworks Sinkhole Cookie Value Snkz	A Network Trojan was detected

Suricata TLS

No Suricata TLS

Queries for the computername (5 events)

Time & API	Arguments	Status	Return
GetComputerNameW Aug. 29, 2021, 12:38 p.m.	computer_name: TEST22-PC	1	1
GetComputerNameW Aug. 29, 2021, 12:38 p.m.	computer_name: TEST22-PC	1	1
GetComputerNameW Aug. 29, 2021, 12:38 p.m.	computer_name: TEST22-PC	1	1
GetComputerNameW Aug. 29, 2021, 12:38 p.m.	computer_name: TEST22-PC	1	1
GetComputerNameW Aug. 29, 2021, 12:38 p.m.	computer_name: TEST22-PC	1	1

Checks if process is being debugged by a debugger (2 events)

Time & API	Arguments	Status	Return	Repeated
IsDebuggerPresent Aug. 29, 2021, 12:38 p.m.			0	0
IsDebuggerPresent Aug. 29, 2021, 12:38 p.m.			0	0

This executable has a PDB path (1 event)

pdb_path

C:\vos.pdb

One or more potentially interesting buffers were extracted, these generally contain injected code, configuration data, etc.

HTTP traffic contains suspicious features which may be indicative of malware related traffic (4 events)

suspicious_features	POST method with no referer header, HTTP version 1.0 used	suspicious_request	POST http://secure.jsc0nten1maker.com/t
suspicious_features	POST method with no referer header, HTTP version 1.0 used	suspicious_request	POST http://static.apiinformationsec.com/t
suspicious_features	POST method with no referer header, HTTP version 1.0 used	suspicious_request	POST http://mel.cloudcontentsmak.com/t
suspicious_features	POST method with no referer header, HTTP version 1.0 used	suspicious_request	POST http://noone.contentmakersbyakamai.ru/t

Performs some HTTP requests (4 events)

request	POST http://secure.jsc0nten1maker.com/t
request	POST http://static.apiinformationsec.com/t
request	POST http://mel.cloudcontentsmak.com/t
request	POST http://noone.contentmakersbyakamai.ru/t

Sends data using the HTTP POST Method (4 events)

request	POST http://secure.jsc0nten1maker.com/t
request	POST http://static.apiinformationsec.com/t
request	POST http://mel.cloudcontentsmak.com/t
request	POST http://noone.contentmakersbyakamai.ru/t

Resolves a suspicious Top Level Domain (TLD) (2 events)

domain	noone.contentmakersbyakamai.ru				description	Russian Federation domain TLD
domain	nicru.supermicrotransapi.ru				description	Russian Federation domain TLD

Allocates read-write-execute memory (usually to unpack itself) (10 events)

Time & API	Arguments	Status
NtProtectVirtualMemory Aug. 29, 2021, 12:38 p.m.	process_identifier: 304 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 length: 110592 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0245a000 process_handle: 0xffffffff	1
NtAllocateVirtualMemory Aug. 29, 2021, 12:38 p.m.	process_identifier: 304 region_size: 114688 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00390000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtProtectVirtualMemory Aug. 29, 2021, 12:38 p.m.	process_identifier: 2236 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00400000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Aug. 29, 2021, 12:38 p.m.	process_identifier: 2236 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x74bf2000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Aug. 29, 2021, 12:38 p.m.	process_identifier: 2236 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0040a000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Aug. 29, 2021, 12:38 p.m.	process_identifier: 2236 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0040a000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Aug. 29, 2021, 12:38 p.m.	process_identifier: 2236 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0040a000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Aug. 29, 2021, 12:38 p.m.	process_identifier: 2236 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0040a000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Aug. 29, 2021, 12:38 p.m.	process_identifier: 2236 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0040a000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Aug. 29, 2021, 12:38 p.m.	process_identifier: 2236 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0040a000 process_handle: 0xffffffff	1

Foreign language identified in PE resource (7 events)

name

RT_ICON

language

LANG_KYRGYZ

filetype

GLS_BINARY_LSB_FIRST

sublanguage

SUBLANG_DEFAULT

offset

0x01fb8188

size

0x00000468

name

RT_ICON

language

LANG_KYRGYZ

filetype

GLS_BINARY_LSB_FIRST

sublanguage

SUBLANG_DEFAULT

offset

0x01fb8188

size

0x00000468

name

RT_ICON

language

LANG_KYRGYZ

filetype

GLS_BINARY_LSB_FIRST

sublanguage

SUBLANG_DEFAULT

offset

0x01fb8188

size

0x00000468

name

RT_ICON

language

LANG_KYRGYZ

filetype

GLS_BINARY_LSB_FIRST

sublanguage

SUBLANG_DEFAULT

offset

0x01fb8188

size

0x00000468

name

RT_ICON

language

LANG_KYRGYZ

filetype

GLS_BINARY_LSB_FIRST

sublanguage

SUBLANG_DEFAULT

offset

0x01fb8188

size

0x00000468

name

RT_ICON

language

LANG_KYRGYZ

filetype

GLS_BINARY_LSB_FIRST

sublanguage

SUBLANG_DEFAULT

offset

0x01fb8188

size

0x00000468

name

RT_GROUP_ICON

language

LANG_KYRGYZ

filetype

data

sublanguage

SUBLANG_DEFAULT

offset

0x01fb85f0

size

0x0000005a

The binary likely contains encrypted or compressed data indicative of a packer (2 events)

section

{u'size_of_data': u'0x0001c800', u'virtual_address': u'0x00030000', u'entropy': 7.876528574026356, u'name': u'.data', u'virtual_size': u'0x01f8435c'}

entropy

7.87652857403

description

A section with a high entropy has been found

entropy

0.364217252396

description

Overall entropy of this PE file is high

Yara rule detected in process memory (8 events)

description	(no description)	rule	DebuggerCheck__GlobalFlags
description	(no description)	rule	DebuggerCheck__QueryInfo
description	(no description)	rule	DebuggerHiding__Thread
description	(no description)	rule	DebuggerHiding__Active
description	(no description)	rule	ThreadControl__Context
description	(no description)	rule	SEH__vectored
description	Checks if being debugged	rule	anti_dbg
description	Bypass DEP	rule	disable_dep

One or more of the buffers contains an embedded PE file (1 event)

buffer

Buffer with sha1: f80747b352de5aa5afe7e822f75b37ac531e7d39

Allocates execute permission to another process indicative of possible code injection (1 event)

Time & API	Arguments	Status	Return	Repeated
NtAllocateVirtualMemory Aug. 29, 2021, 12:38 p.m.	process_identifier: 2236 region_size: 380928 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00400000 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0x00000080	1	0	0

Installs itself for autorun at Windows startup (1 event)

reg_key

HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run\8b5f719852873b61b0df27c17a9f0f0d

reg_value

regsvr32.exe /s /n /u /i:"C:\Users\test22\AppData\Roaming\5XFYVL3GYM.txt" scrobj.dll.

Potential code injection by writing to the memory of another process (1 event)

Time & API	Arguments	Status	Return	Repeated
WriteProcessMemory Aug. 29, 2021, 12:38 p.m.	buffer: @ base_address: 0x7efde008 process_identifier: 2236 process_handle: 0x00000080	1	1	0

Used NtSetContextThread to modify a thread in a remote process indicative of process injection (2 events)

Time & API	Arguments	Status	Return	Repeated
Process injection	Process 304 called NtSetContextThread to modify thread in remote process 2236
NtSetContextThread Aug. 29, 2021, 12:38 p.m.	registers.eip: 2007957956 registers.esp: 1638384 registers.edi: 0 registers.eax: 4566672 registers.ebp: 0 registers.edx: 0 registers.ebx: 2130567168 registers.esi: 0 registers.ecx: 0 thread_handle: 0x0000007c process_identifier: 2236	1	0	0

Resumed a suspended thread in a remote process potentially indicative of process injection (2 events)

Time & API	Arguments	Status	Return	Repeated
Process injection	Process 304 resumed a thread in remote process 2236
NtResumeThread Aug. 29, 2021, 12:38 p.m.	thread_handle: 0x0000007c suspend_count: 1 process_identifier: 2236	1	0	0

Connects to an IP address that is no longer responding to requests (legitimate services will remain up-and-running usually) (1 event)

dead_host

37.1.207.157:80

Executed a process and injected code into it, probably while unpacking (7 events)

Time & API	Arguments	Status	Return
CreateProcessInternalW Aug. 29, 2021, 12:38 p.m.	thread_identifier: 1328 thread_handle: 0x0000007c process_identifier: 2236 current_directory: filepath: C:\Users\test22\AppData\Local\Temp\imcr.exe track: 1 command_line: "C:\Users\test22\AppData\Local\Temp\imcr.exe" filepath_r: C:\Users\test22\AppData\Local\Temp\imcr.exe stack_pivoted: 0 creation_flags: 134217732 (CREATE_NO_WINDOW\|CREATE_SUSPENDED) inherit_handles: 0 process_handle: 0x00000080	1	1
NtGetContextThread Aug. 29, 2021, 12:38 p.m.	thread_handle: 0x0000007c	1	0
NtUnmapViewOfSection Aug. 29, 2021, 12:38 p.m.	base_address: 0x00400000 region_size: 4096 process_identifier: 2236 process_handle: 0x00000080	1	0
NtAllocateVirtualMemory Aug. 29, 2021, 12:38 p.m.	process_identifier: 2236 region_size: 380928 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00400000 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0x00000080	1	0
WriteProcessMemory Aug. 29, 2021, 12:38 p.m.	buffer: @ base_address: 0x7efde008 process_identifier: 2236 process_handle: 0x00000080	1	1
NtSetContextThread Aug. 29, 2021, 12:38 p.m.	registers.eip: 2007957956 registers.esp: 1638384 registers.edi: 0 registers.eax: 4566672 registers.ebp: 0 registers.edx: 0 registers.ebx: 2130567168 registers.esi: 0 registers.ecx: 0 thread_handle: 0x0000007c process_identifier: 2236	1	0
NtResumeThread Aug. 29, 2021, 12:38 p.m.	thread_handle: 0x0000007c suspend_count: 1 process_identifier: 2236	1	0

File has been identified by 48 AntiVirus engines on VirusTotal as malicious (48 events)

Bkav	W32.AIDetect.malware1
Lionic	Trojan.Win32.Injuke.4!c
Elastic	malicious (high confidence)
DrWeb	Trojan.DownLoader41.37215
MicroWorld-eScan	Trojan.GenericKD.37493413
FireEye	Generic.mg.99d398716a945554
McAfee	Packed-GDT!99D398716A94
Cylance	Unsafe
Sangfor	Trojan.Win32.Save.a
Alibaba	Trojan:Win32/Injuke.d21dfc2b
Cybereason	malicious.519680
BitDefenderTheta	Gen:NN.ZexaF.34110.tqW@aOGd6ChG
Cyren	W32/Kryptik.EYC.gen!Eldorado
Symantec	ML.Attribute.HighConfidence
ESET-NOD32	a variant of Win32/Kryptik.HMGI
APEX	Malicious
Paloalto	generic.ml
ClamAV	Win.Packed.Generic-9888857-0
Kaspersky	HEUR:Trojan.Win32.Injuke.gen
BitDefender	Trojan.GenericKD.37493413
Avast	Win32:TrojanX-gen [Trj]
Rising	Malware.Obscure/Heur!1.A89F (CLASSIC)
Ad-Aware	Trojan.GenericKD.37493413
Emsisoft	Trojan.GenericKD.37493413 (B)
TrendMicro	Ransom_HPGANDCRAB.SMONT2
McAfee-GW-Edition	BehavesLike.Win32.Packed.fc
Sophos	Mal/Generic-S
Avira	EXP/YAV.Minerva.guifh
Kingsoft	Win32.Troj.Undef.(kcloud)
Microsoft	Trojan:Win32/Sabsik.FL.B!ml
Arcabit	Trojan.Fragtor.D3043
ZoneAlarm	HEUR:Trojan.Win32.Injuke.gen
GData	Win32.Trojan.PSE.11V48EH
Cynet	Malicious (score: 100)
AhnLab-V3	Infostealer/Win.SmokeLoader.R439087
Acronis	suspicious
ALYac	Gen:Variant.Fragtor.12355
MAX	malware (ai score=82)
Malwarebytes	Trojan.MalPack.GS
TrendMicro-HouseCall	Ransom_HPGANDCRAB.SMONT2
Tencent	Win32.Trojan.Injuke.Hwwh
SentinelOne	Static AI - Suspicious PE
eGambit	Unsafe.AI_Score_96%
Fortinet	W32/Kryptik.HMFH!tr
AVG	Win32:TrojanX-gen [Trj]
Panda	Trj/GdSda.A
CrowdStrike	win/malicious_confidence_100% (W)
MaxSecure	Trojan.Malware.300983.susgen

imcr.exe

Process Tree Toggle all

Network Toggle all

Suricata Toggle all

Suricata Alerts

Suricata TLS

Signatures Toggle All