Summary | ZeroBOX

Category	Machine	Started	Completed
FILE	s1_win7_x6401	Sept. 28, 2021, 10:08 a.m.	Sept. 28, 2021, 10:10 a.m.

Size	13.7KB
Type	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
MD5	`354b2d0793453d6be6e92cb740f170e4`
SHA256	`df841db0f1f8f968ec6fc8c0d8bbd618bbacdcd7bf8146ad0267371884071576`
CRC32	`1C8DBE66`
ssdeep	`384:w7eYdIemWy67MPPpLrCGhGAp9E+88ZpHO5IK3:otdFvupLrBp9E+8iROT`
PDB Path	c:\Users\PE\AppData\Local\Temp\hCdRkFBziAAPbCk.pdb
Yara	PE_Header_Zero - PE File Signature Generic_Malware_Zero - Generic Malware Is_DotNET_EXE - (no description) Win_Backdoor_AsyncRAT_Zero - Win Backdoor AsyncRAT IsPE32 - (no description)

projecta.exe "C:\Users\test22\AppData\Local\Temp\projecta.exe"
1016

Name	Response	Post-Analysis Lookup
a.uguu.se	A 188.40.83.211	188.40.83.211
cdn.discordapp.com	A 162.159.135.233 A 162.159.134.233 A 162.159.129.233 A 162.159.130.233 A 162.159.133.233	162.159.130.233

IP Address	Status	Action
162.159.134.233	Active	Moloch
164.124.101.2	Active	Moloch
188.40.83.211	Active	Moloch

Suricata Alerts

Flow	SID	Signature	Category
TCP 192.168.56.101:49199 -> 162.159.134.233:443	906200022	SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee)	undefined
TCP 192.168.56.101:49201 -> 188.40.83.211:443	906200022	SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee)	undefined

Suricata TLS

Flow	Issuer	Subject	Fingerprint
TLS 1.2 192.168.56.101:49199 162.159.134.233:443	C=US, O=Cloudflare, Inc., CN=Cloudflare Inc ECC CA-3	C=US, ST=CA, L=San Francisco, O=Cloudflare, Inc., CN=sni.cloudflaressl.com	54:e1:a7:9d:cc:c8:60:86:f1:a5:da:74:0e:5a:ab:45:df:37:8a:78
TLS 1.2 192.168.56.101:49201 188.40.83.211:443	C=US, O=Let's Encrypt, CN=R3	CN=a.uguu.se	79:2e:12:60:e2:29:ab:f7:71:84:cc:31:fb:cc:8d:e0:d6:51:0c:17

Queries for the computername (2 events)

Time & API	Arguments	Status	Return	Repeated
GetComputerNameA Sept. 28, 2021, 10:08 a.m.	computer_name: TEST22-PC	1	1	0
GetComputerNameW Sept. 28, 2021, 10:08 a.m.	computer_name: TEST22-PC	1	1	0

Checks if process is being debugged by a debugger (4 events)

Time & API	Arguments	Status	Return	Repeated
IsDebuggerPresent Sept. 28, 2021, 10:08 a.m.			0	0
IsDebuggerPresent Sept. 28, 2021, 10:08 a.m.			0	0
IsDebuggerPresent Sept. 28, 2021, 10:08 a.m.			0	0
IsDebuggerPresent Sept. 28, 2021, 10:08 a.m.			0	0

This executable has a PDB path (1 event)

pdb_path

c:\Users\PE\AppData\Local\Temp\hCdRkFBziAAPbCk.pdb

Checks amount of memory in system, this can be used to detect virtual machines that have a low amount of memory available (1 event)

Time & API	Arguments	Status	Return	Repeated
GlobalMemoryStatusEx Sept. 28, 2021, 10:08 a.m.		1	1	0

One or more potentially interesting buffers were extracted, these generally contain injected code, configuration data, etc.

HTTP traffic contains suspicious features which may be indicative of malware related traffic (2 events)

suspicious_features	GET method with no useragent header				suspicious_request	GET https://cdn.discordapp.com/attachments/879141740978769922/887025913261359164/runpe.png
suspicious_features	GET method with no useragent header				suspicious_request	GET https://a.uguu.se/WmccEYfL.txt

Performs some HTTP requests (2 events)

request	GET https://cdn.discordapp.com/attachments/879141740978769922/887025913261359164/runpe.png
request	GET https://a.uguu.se/WmccEYfL.txt

Allocates read-write-execute memory (usually to unpack itself) (18 events)

Time & API	Arguments	Status
NtAllocateVirtualMemory Sept. 28, 2021, 10:08 a.m.	process_identifier: 1016 region_size: 327680 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00350000 allocation_type: 8192 (MEM_RESERVE) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Sept. 28, 2021, 10:08 a.m.	process_identifier: 1016 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00360000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtProtectVirtualMemory Sept. 28, 2021, 10:08 a.m.	process_identifier: 1016 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x72741000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Sept. 28, 2021, 10:08 a.m.	process_identifier: 1016 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x72742000 process_handle: 0xffffffff	1
NtAllocateVirtualMemory Sept. 28, 2021, 10:08 a.m.	process_identifier: 1016 region_size: 983040 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x005a0000 allocation_type: 8192 (MEM_RESERVE) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Sept. 28, 2021, 10:08 a.m.	process_identifier: 1016 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00650000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Sept. 28, 2021, 10:08 a.m.	process_identifier: 1016 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x003e2000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Sept. 28, 2021, 10:08 a.m.	process_identifier: 1016 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00415000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Sept. 28, 2021, 10:08 a.m.	process_identifier: 1016 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0041b000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Sept. 28, 2021, 10:08 a.m.	process_identifier: 1016 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00417000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Sept. 28, 2021, 10:08 a.m.	process_identifier: 1016 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x003fc000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Sept. 28, 2021, 10:08 a.m.	process_identifier: 1016 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00500000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Sept. 28, 2021, 10:08 a.m.	process_identifier: 1016 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x003ea000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Sept. 28, 2021, 10:08 a.m.	process_identifier: 1016 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0040a000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Sept. 28, 2021, 10:08 a.m.	process_identifier: 1016 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00407000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Sept. 28, 2021, 10:08 a.m.	process_identifier: 1016 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00406000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Sept. 28, 2021, 10:08 a.m.	process_identifier: 1016 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0040b000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Sept. 28, 2021, 10:08 a.m.	process_identifier: 1016 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x003fa000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1

Checks adapter addresses which can be used to detect virtual network interfaces (1 event)

Time & API	Arguments	Status	Return	Repeated
GetAdaptersAddresses Sept. 28, 2021, 10:08 a.m.	flags: 15 family: 0		111	0

Installs itself for autorun at Windows startup (1 event)

reg_key

HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\RunOnce\uFzgJpBbCZdobdR

reg_value

C:\Users\test22\AppData\Roaming\LpEwT\eLAKB.exe

File has been identified by 35 AntiVirus engines on VirusTotal as malicious (35 events)

Lionic	Trojan.MSIL.Bladabindi.m!c
CAT-QuickHeal	Backdoor.MSIL
ALYac	Trojan.GenericKD.37592847
Zillya	Downloader.Tiny.Win32.21850
Alibaba	Backdoor:MSIL/Bladabindi.1f3827b4
CrowdStrike	win/malicious_confidence_100% (W)
Arcabit	Trojan.Generic.D23D9F0F
ESET-NOD32	a variant of MSIL/TrojanDownloader.Tiny.BGM
Paloalto	generic.ml
Kaspersky	HEUR:Backdoor.MSIL.Bladabindi.gen
BitDefender	Trojan.GenericKD.37592847
NANO-Antivirus	Trojan.Win32.Bladabindi.jceykg
MicroWorld-eScan	Trojan.GenericKD.37592847
Avast	Win32:Trojan-gen
Ad-Aware	Trojan.GenericKD.37592847
Emsisoft	Trojan.GenericKD.37592847 (B)
McAfee-GW-Edition	RDN/Generic Downloader.x
FireEye	Trojan.GenericKD.37592847
Sophos	Mal/Generic-S
Ikarus	Trojan-Downloader.MSIL.Tiny
Kingsoft	Win32.Hack.Undef.(kcloud)
Gridinsoft	Trojan.Win32.Downloader.sa
Microsoft	Trojan:Win32/Sabsik.TE.B!ml
ZoneAlarm	HEUR:Backdoor.MSIL.Bladabindi.gen
GData	Trojan.GenericKD.37592847
McAfee	RDN/Generic Downloader.x
MAX	malware (ai score=100)
VBA32	TScope.Trojan.MSIL
TrendMicro-HouseCall	TROJ_GEN.R011C0PIM21
Yandex	Trojan.DL.Tiny!JfxORCMMQ/4
SentinelOne	Static AI - Malicious PE
Fortinet	Malicious_Behavior.SB
BitDefenderTheta	Gen:NN.ZemsilF.34170.am1@a8LaG8
AVG	Win32:Trojan-gen
Panda	Trj/GdSda.A

projecta.exe

Process Tree Toggle all

Network Toggle all

Suricata Toggle all

Suricata Alerts

Suricata TLS

Signatures Toggle All