Summary | ZeroBOX

Category	Machine	Started	Completed
FILE	s1_win7_x6401	Aug. 31, 2021, 7:51 a.m.	Aug. 31, 2021, 7:53 a.m.

Size	444.0KB
Type	PE32 executable (GUI) Intel 80386, for MS Windows
MD5	`75fc478585b12d3a8f0216b1b28c6944`
SHA256	`ddff09f62985a15537bf510e1b95a0e31b5714a498c050671df0325802a7f3e9`
CRC32	`EEF47A33`
ssdeep	`6144:4IX3PZ/SLdat3ZjyPt7Z3cGwzwo38Pt7cjqJWa:CatJuP5NSt8P5cEWa`
Yara	PE_Header_Zero - PE File Signature UPX_Zero - UPX packed file IsPE32 - (no description)

AXC.exe "C:\Users\test22\AppData\Local\Temp\AXC.exe"
2776
- AXC.exe "C:\Users\test22\AppData\Local\Temp\AXC.exe"
  2532
  - wscript.exe "C:\Windows\System32\WScript.exe" "C:\Users\test22\AppData\Local\Temp\install.vbs"
    1240
    - cmd.exe "C:\Windows\System32\cmd.exe" /c "C:\Users\test22\AppData\Roaming\vlc.exe"
      620
      - vlc.exe C:\Users\test22\AppData\Roaming\vlc.exe
        2660
        
        vlc.exe C:\Users\test22\AppData\Roaming\vlc.exe
        872

Name	Response	Post-Analysis Lookup
swryijgrvcsgkopnmcdertvgdswbvmophtfdczxs.ydns.eu	A 78.129.249.105	78.129.249.105

IP Address	Status	Action
103.133.111.149	Active	Moloch
164.124.101.2	Active	Moloch
78.129.249.105	Active	Moloch

Suricata Alerts

Flow	SID	Signature	Category
TCP 192.168.56.101:49210 -> 103.133.111.149:80	2018752	ET MALWARE Generic .bin download from Dotted Quad	A Network Trojan was detected
TCP 192.168.56.101:49202 -> 103.133.111.149:80	2018752	ET MALWARE Generic .bin download from Dotted Quad	A Network Trojan was detected

Suricata TLS

No Suricata TLS

Checks amount of memory in system, this can be used to detect virtual machines that have a low amount of memory available (1 event)

Time & API	Arguments	Status	Return	Repeated
GlobalMemoryStatusEx Aug. 31, 2021, 7:51 a.m.		1	1	0

HTTP traffic contains suspicious features which may be indicative of malware related traffic (1 event)

suspicious_features

Connection to IP address

suspicious_request

GET http://103.133.111.149/Gee_remcos%202020_eborUv118.bin

Performs some HTTP requests (1 event)

request

GET http://103.133.111.149/Gee_remcos%202020_eborUv118.bin

Allocates read-write-execute memory (usually to unpack itself) (9 events)

Time & API	Arguments	Status
NtProtectVirtualMemory Aug. 31, 2021, 7:51 a.m.	process_identifier: 2776 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x72d72000 process_handle: 0xffffffff	1
NtAllocateVirtualMemory Aug. 31, 2021, 7:51 a.m.	process_identifier: 2776 region_size: 73728 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x03cc0000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtProtectVirtualMemory Aug. 31, 2021, 7:51 a.m.	process_identifier: 2776 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 876544 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x773b0000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Aug. 31, 2021, 7:52 a.m.	process_identifier: 2532 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 876544 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x773b0000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Aug. 31, 2021, 7:52 a.m.	process_identifier: 1240 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x72d72000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Aug. 31, 2021, 7:52 a.m.	process_identifier: 2660 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x72d72000 process_handle: 0xffffffff	1
NtAllocateVirtualMemory Aug. 31, 2021, 7:52 a.m.	process_identifier: 2660 region_size: 73728 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x03c10000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtProtectVirtualMemory Aug. 31, 2021, 7:52 a.m.	process_identifier: 2660 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 876544 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x773b0000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Aug. 31, 2021, 7:52 a.m.	process_identifier: 872 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 876544 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x773b0000 process_handle: 0xffffffff	1

Creates a suspicious process (1 event)

cmdline

"C:\Windows\System32\cmd.exe" /c "C:\Users\test22\AppData\Roaming\vlc.exe"

Drops a binary and executes it (1 event)

file	C:\Users\test22\AppData\Local\Temp\install.vbs

A process created a hidden window (2 events)

Time & API	Arguments	Status	Return	Repeated
ShellExecuteExW Aug. 31, 2021, 7:52 a.m.	show_type: 0 filepath_r: C:\Users\test22\AppData\Local\Temp\install.vbs parameters: filepath: C:\Users\test22\AppData\Local\Temp\install.vbs	1	1	0
ShellExecuteExW Aug. 31, 2021, 7:52 a.m.	show_type: 0 filepath_r: cmd parameters: /c "C:\Users\test22\AppData\Roaming\vlc.exe" filepath: cmd	1	1	0

Changes read-write memory protection to read-execute (probably to avoid detection when setting all RWX flags at the same time) (1 event)

Time & API	Arguments	Status	Return	Repeated
NtProtectVirtualMemory Aug. 31, 2021, 7:51 a.m.	process_identifier: 2776 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 length: 24576 protection: 32 (PAGE_EXECUTE_READ) base_address: 0x01c50000 process_handle: 0xffffffff	1	0	0

Communicates with host for which no DNS query was performed (1 event)

host

103.133.111.149

Enumerates services, possibly for anti-virtualization (1 event)

Time & API	Arguments	Status	Return	Repeated
EnumServicesStatusA Aug. 31, 2021, 7:51 a.m.	service_handle: 0x00337200 service_type: 48 service_status: 3		0	0

Installs itself for autorun at Windows startup (2 events)

reg_key	HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run\win				reg_value	"C:\Users\test22\AppData\Roaming\vlc.exe"
reg_key	HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run\win				reg_value	"C:\Users\test22\AppData\Roaming\vlc.exe"

Deletes executed files from disk (1 event)

file	C:\Users\test22\AppData\Local\Temp\install.vbs

Creates a windows hook that monitors keyboard input (keylogger) (1 event)

Time & API	Arguments	Status	Return	Repeated
SetWindowsHookExA Aug. 31, 2021, 7:52 a.m.	thread_identifier: 0 callback_function: 0x004052ba hook_identifier: 13 (WH_KEYBOARD_LL) module_address: 0x00000000	1	15008407	0

One or more non-whitelisted processes were created (2 events)

parent_process	wscript.exe				martian_process	"C:\Windows\System32\cmd.exe" /c "C:\Users\test22\AppData\Roaming\vlc.exe"
parent_process	wscript.exe				martian_process	cmd /c "C:\Users\test22\AppData\Roaming\vlc.exe"

File has been identified by 20 AntiVirus engines on VirusTotal as malicious (20 events)

McAfee	Artemis!75FC478585B1
Cylance	Unsafe
Sangfor	Trojan.Win32.Save.a
CrowdStrike	win/malicious_confidence_90% (W)
ESET-NOD32	a variant of Win32/GenKryptik.FJTP
APEX	Malicious
Paloalto	generic.ml
Kaspersky	HEUR:Trojan.Win32.Generic
Avast	FileRepMalware
McAfee-GW-Edition	BehavesLike.Win32.Generic.gm
Sophos	Mal/Generic-S
Webroot	W32.Trojan.Gen
Microsoft	Trojan:Win32/Sabsik.FL.B!ml
SentinelOne	Static AI - Suspicious PE
eGambit	Unsafe.AI_Score_78%
Fortinet	W32/Kryptik.EOJP!tr
BitDefenderTheta	Gen:NN.ZevbaF.34110.Bm0@a8xtznpG
AVG	FileRepMalware
Cybereason	malicious.2cae47
MaxSecure	Trojan.Malware.300983.susgen

Connects to an IP address that is no longer responding to requests (legitimate services will remain up-and-running usually) (1 event)

dead_host

78.129.249.105:2017

The process wscript.exe wrote an executable file to disk which it then attempted to execute (2 events)

file	C:\Windows\SysWOW64\wscript.exe
file	C:\Windows\System32\cmd.exe

AXC.exe

Process Tree Toggle all

Network Toggle all

Suricata Toggle all

Suricata Alerts

Suricata TLS

Signatures Toggle All