Summary | ZeroBOX

Category	Machine	Started	Completed
FILE	s1_win7_x6401	Sept. 29, 2021, 10:05 a.m.	Sept. 29, 2021, 10:19 a.m.

Size	278.0KB
Type	PE32 executable (GUI) Intel 80386 (stripped to external PDB), for MS Windows
MD5	`e134bca3704fcb507dc6b6524114417c`
SHA256	`ef4008effed1c6251e52ca8ea9db6dd7dfad35aaa84ced8335225c9d8d77ac84`
CRC32	`998EC76C`
ssdeep	`6144:AR9K7cARH27K66cKAz4M0csFdpZvTtLyI/wsa:AbK7LRH27K6lDqLFHZvTtLf/j`
Yara	PE_Header_Zero - PE File Signature Malicious_Library_Zero - Malicious_Library IsPE32 - (no description)

svchost.exe "C:\Users\test22\AppData\Local\Temp\svchost.exe"
1108

Name	Response	Post-Analysis Lookup
No hosts contacted.

IP Address	Status	Action
101.99.90.100	Active	Moloch
164.124.101.2	Active	Moloch

Suricata Alerts

Flow	SID	Signature	Category
TCP 192.168.56.101:49208 -> 101.99.90.100:443	2028401	ET JA3 Hash - Possible Malware - Various Trickbot/Kovter/Dridex	Unknown Traffic
TCP 192.168.56.101:49201 -> 101.99.90.100:443	2028401	ET JA3 Hash - Possible Malware - Various Trickbot/Kovter/Dridex	Unknown Traffic
TCP 192.168.56.101:49212 -> 101.99.90.100:443	2028401	ET JA3 Hash - Possible Malware - Various Trickbot/Kovter/Dridex	Unknown Traffic
TCP 192.168.56.101:49202 -> 101.99.90.100:443	2028401	ET JA3 Hash - Possible Malware - Various Trickbot/Kovter/Dridex	Unknown Traffic
TCP 192.168.56.101:49209 -> 101.99.90.100:443	2028401	ET JA3 Hash - Possible Malware - Various Trickbot/Kovter/Dridex	Unknown Traffic
TCP 192.168.56.101:49213 -> 101.99.90.100:443	2028401	ET JA3 Hash - Possible Malware - Various Trickbot/Kovter/Dridex	Unknown Traffic
TCP 101.99.90.100:443 -> 192.168.56.101:49211	2260001	SURICATA Applayer Wrong direction first Data	Generic Protocol Command Decode
TCP 101.99.90.100:443 -> 192.168.56.101:49204	2260001	SURICATA Applayer Wrong direction first Data	Generic Protocol Command Decode
TCP 101.99.90.100:443 -> 192.168.56.101:49215	2260001	SURICATA Applayer Wrong direction first Data	Generic Protocol Command Decode

Suricata TLS

No Suricata TLS

Queries for the computername (1 event)

Time & API	Arguments	Status	Return	Repeated
GetComputerNameA Sept. 29, 2021, 10:05 a.m.	computer_name: TEST22-PC	1	1	0

A process attempted to delay the analysis task. (1 event)

description

svchost.exe tried to sleep 197 seconds, actually delayed analysis time by 197 seconds

Changes read-write memory protection to read-execute (probably to avoid detection when setting all RWX flags at the same time) (1 event)

Time & API	Arguments	Status	Return	Repeated
NtProtectVirtualMemory Sept. 29, 2021, 10:05 a.m.	process_identifier: 1108 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 length: 212992 protection: 32 (PAGE_EXECUTE_READ) base_address: 0x009d0000 process_handle: 0xffffffff	1	0	0

Communicates with host for which no DNS query was performed (1 event)

host

101.99.90.100

File has been identified by 53 AntiVirus engines on VirusTotal as malicious (50 out of 53 events)

Bkav	W32.AIDetect.malware1
Elastic	malicious (high confidence)
MicroWorld-eScan	Gen:Variant.Fugrafa.858
ALYac	Gen:Variant.Fugrafa.858
Cylance	Unsafe
Sangfor	Trojan.Win32.Save.a
K7AntiVirus	Trojan ( 005624dc1 )
K7GW	Trojan ( 005624dc1 )
CrowdStrike	win/malicious_confidence_90% (W)
Arcabit	Trojan.Fugrafa.858
Cyren	W32/Diple.F.gen!Eldorado
Symantec	Backdoor.Cobalt
ESET-NOD32	a variant of Win32/Rozena.AMZ
APEX	Malicious
Paloalto	generic.ml
ClamAV	Win.Trojan.CobaltStrike-7899872-1
Kaspersky	HEUR:Trojan.Win32.CobaltStrike.gen
BitDefender	Gen:Variant.Fugrafa.858
NANO-Antivirus	Trojan.Win32.Rozena.hpcmlv
ViRobot	Trojan.Win32.Cobalt.284672.A
Avast	Win32:HacktoolX-gen [Trj]
Tencent	Hacktool.Win32.CobaltStrike.za
Ad-Aware	Gen:Variant.Fugrafa.858
TACHYON	Trojan/W32.Agent.284672.IN
Sophos	Mal/Generic-R + ATK/Cobalt-CC
DrWeb	BackDoor.Siggen2.247
TrendMicro	Trojan.Win32.COBALT.SM
McAfee-GW-Edition	BehavesLike.Win32.Kudj.dh
FireEye	Generic.mg.e134bca3704fcb50
Emsisoft	Trojan.Rozena (A)
Ikarus	Trojan.Win32.Rozena
Jiangmin	Trojan.Cometer.aww
Webroot	W32,backdoor.Rozena
Avira	TR/Crypt.XPACK.Gen7
Antiy-AVL	Trojan/Generic.ASMalwS.30CAC8E
Gridinsoft	Trojan.Win32.Gen.oa!s1
Microsoft	Trojan:Win32/Cobaltstrike.MK!MTB
GData	Gen:Variant.Fugrafa.858
Cynet	Malicious (score: 100)
AhnLab-V3	Trojan/Win32.CobaltStrike.R329694
Acronis	suspicious
McAfee	GenericRXMO-OO!E134BCA3704F
MAX	malware (ai score=84)
VBA32	Trojan.CobaltStrike
Malwarebytes	Backdoor.Rozena
TrendMicro-HouseCall	Trojan.Win32.COBALT.SM
Rising	Backdoor.CobaltStrike!1.D049 (CLASSIC)
Yandex	Trojan.GenAsa!/C5jzoNrl5s
SentinelOne	Static AI - Malicious PE
MaxSecure	Trojan.Malware.121218.susgen

svchost.exe

Process Tree Toggle all

Network Toggle all

Suricata Toggle all

Suricata Alerts

Suricata TLS

Signatures Toggle All