popup
Summary | ZeroBOX
  1. Home
  2. Result
  3. Report
  4. Detail Analysis

mx.exe

NSIS Malicious Library PE File DLL OS Processor Check PE32
  1. Resubmit sample
Category Machine Started Completed
FILE s1_win7_x6401 Oct. 8, 2021, 11:17 a.m. Oct. 8, 2021, 11:25 a.m.
Size 293.0KB
Type PE32 executable (GUI) Intel 80386, for MS Windows, Nullsoft Installer self-extracting archive
MD5 9541217b4276268f9cf0e6e2f01a08e2
SHA256 4217bf1cf710804c6b4a7b6a7d03974aaa655e512e3bf854c193feb7b2a8d422
CRC32 0446BC74
ssdeep 6144:F8LxBsiXNeJJrLYAmKl3LqeK47ZQQg5PnHoFWkcpWnVSnr1k+ZGk:/idWh68LqeKYm8ZSni+ZGk
Yara
  • PE_Header_Zero - PE File Signature
  • IsPE32 - (no description)
  • Malicious_Library_Zero - Malicious_Library
  • NSIS_Installer - Null Soft Installer

Suricata Alerts

Flow SID Signature Category
TCP 192.168.56.101:49209 -> 52.118.136.180:80 2031412 ET MALWARE FormBook CnC Checkin (GET) Malware Command and Control Activity Detected
TCP 192.168.56.101:49209 -> 52.118.136.180:80 2031449 ET MALWARE FormBook CnC Checkin (GET) Malware Command and Control Activity Detected
TCP 192.168.56.101:49209 -> 52.118.136.180:80 2031453 ET MALWARE FormBook CnC Checkin (GET) Malware Command and Control Activity Detected
TCP 192.168.56.101:49223 -> 104.18.26.58:80 2031412 ET MALWARE FormBook CnC Checkin (GET) Malware Command and Control Activity Detected
TCP 192.168.56.101:49223 -> 104.18.26.58:80 2031449 ET MALWARE FormBook CnC Checkin (GET) Malware Command and Control Activity Detected
TCP 192.168.56.101:49223 -> 104.18.26.58:80 2031453 ET MALWARE FormBook CnC Checkin (GET) Malware Command and Control Activity Detected
TCP 192.168.56.101:49219 -> 23.27.137.72:80 2031412 ET MALWARE FormBook CnC Checkin (GET) Malware Command and Control Activity Detected
TCP 192.168.56.101:49219 -> 23.27.137.72:80 2031449 ET MALWARE FormBook CnC Checkin (GET) Malware Command and Control Activity Detected
TCP 192.168.56.101:49219 -> 23.27.137.72:80 2031453 ET MALWARE FormBook CnC Checkin (GET) Malware Command and Control Activity Detected
TCP 192.168.56.101:49207 -> 68.65.122.75:80 2031412 ET MALWARE FormBook CnC Checkin (GET) Malware Command and Control Activity Detected
TCP 192.168.56.101:49207 -> 68.65.122.75:80 2031449 ET MALWARE FormBook CnC Checkin (GET) Malware Command and Control Activity Detected
TCP 192.168.56.101:49207 -> 68.65.122.75:80 2031453 ET MALWARE FormBook CnC Checkin (GET) Malware Command and Control Activity Detected
TCP 192.168.56.101:49205 -> 178.32.114.31:80 2031412 ET MALWARE FormBook CnC Checkin (GET) Malware Command and Control Activity Detected
TCP 192.168.56.101:49205 -> 178.32.114.31:80 2031449 ET MALWARE FormBook CnC Checkin (GET) Malware Command and Control Activity Detected
TCP 192.168.56.101:49205 -> 178.32.114.31:80 2031453 ET MALWARE FormBook CnC Checkin (GET) Malware Command and Control Activity Detected
TCP 192.168.56.101:49215 -> 154.213.157.16:80 2031412 ET MALWARE FormBook CnC Checkin (GET) Malware Command and Control Activity Detected
TCP 192.168.56.101:49215 -> 154.213.157.16:80 2031449 ET MALWARE FormBook CnC Checkin (GET) Malware Command and Control Activity Detected
TCP 192.168.56.101:49215 -> 154.213.157.16:80 2031453 ET MALWARE FormBook CnC Checkin (GET) Malware Command and Control Activity Detected
TCP 192.168.56.101:49217 -> 156.234.82.249:80 2031412 ET MALWARE FormBook CnC Checkin (GET) Malware Command and Control Activity Detected
TCP 192.168.56.101:49217 -> 156.234.82.249:80 2031449 ET MALWARE FormBook CnC Checkin (GET) Malware Command and Control Activity Detected
TCP 192.168.56.101:49217 -> 156.234.82.249:80 2031453 ET MALWARE FormBook CnC Checkin (GET) Malware Command and Control Activity Detected
TCP 192.168.56.101:49211 -> 162.241.24.116:80 2031412 ET MALWARE FormBook CnC Checkin (GET) Malware Command and Control Activity Detected
TCP 192.168.56.101:49211 -> 162.241.24.116:80 2031449 ET MALWARE FormBook CnC Checkin (GET) Malware Command and Control Activity Detected
TCP 192.168.56.101:49211 -> 162.241.24.116:80 2031453 ET MALWARE FormBook CnC Checkin (GET) Malware Command and Control Activity Detected
TCP 192.168.56.101:49203 -> 68.65.123.42:80 2031412 ET MALWARE FormBook CnC Checkin (GET) Malware Command and Control Activity Detected
TCP 192.168.56.101:49203 -> 68.65.123.42:80 2031449 ET MALWARE FormBook CnC Checkin (GET) Malware Command and Control Activity Detected
TCP 192.168.56.101:49203 -> 68.65.123.42:80 2031453 ET MALWARE FormBook CnC Checkin (GET) Malware Command and Control Activity Detected
TCP 192.168.56.101:49213 -> 192.185.209.235:80 2031412 ET MALWARE FormBook CnC Checkin (GET) Malware Command and Control Activity Detected
TCP 192.168.56.101:49213 -> 192.185.209.235:80 2031449 ET MALWARE FormBook CnC Checkin (GET) Malware Command and Control Activity Detected
TCP 192.168.56.101:49213 -> 192.185.209.235:80 2031453 ET MALWARE FormBook CnC Checkin (GET) Malware Command and Control Activity Detected

Suricata TLS

No Suricata TLS

Time & API Arguments Status Return Repeated

GetComputerNameW

 computer_name: TEST22-PC
1 1 0
Time & API Arguments Status Return Repeated

GlobalMemoryStatusEx

 1 1 0
section .ndata
suspicious_features GET method with no useragent header suspicious_request GET http://www.onlyforu14.rest/noha/?Mjn8dTK0=P/l8qiYiqt8kvrDBUGtG7DlBr1gw3QxKROVjrB5CU3iUOyLfx1uglQZs8tc2Ej0fs967LZqC&IR9Dk4=3fFxw
suspicious_features GET method with no useragent header suspicious_request GET http://www.bois-applique.com/noha/?Mjn8dTK0=bUhQERLpyNF3S/4WPZx/2yInVQcXiLPDhxdoMCXhoM+5+115cTKOZoaz7w3+FhRX4eW13PBz&IR9Dk4=3fFxw
suspicious_features GET method with no useragent header suspicious_request GET http://www.efficientmother.com/noha/?Mjn8dTK0=Kn8BG0j13PT+fdehn0ecRK5TtgM7hEwDx6Ir9myzuy5hft3py86IuSi7z6NlkX23/IG2RvpY&IR9Dk4=3fFxw
suspicious_features GET method with no useragent header suspicious_request GET http://www.unarecord.com/noha/?Mjn8dTK0=YvZkpRzIvhyEmlzzRS448ue/J8Mk5cJYV8d0kFvUSx81G2wer5LDh4vokaiGyVzfr6bGhK1c&IR9Dk4=3fFxw
suspicious_features GET method with no useragent header suspicious_request GET http://www.standardizedsubmissions.com/noha/?Mjn8dTK0=GK9Iij4dWGdWLGI8rL9KorDi156VJ86bzIwgF26pZJPilePG3H+sAuSIpYDMLu4exuJwhJUg&IR9Dk4=3fFxw
suspicious_features GET method with no useragent header suspicious_request GET http://www.artehamburguer.com/noha/?Mjn8dTK0=DIBCgQlqZpY9Thmaxf2kwZI9o6lnh3R5a85wuhZ9ARcS/yE4SOqWB+pyUDCzI4sO9p7f2GE3&IR9Dk4=3fFxw
suspicious_features GET method with no useragent header suspicious_request GET http://www.r2d2u.com/noha/?Mjn8dTK0=ZqhtMyjM+olvYlg5E9e4KUZ/Rp6UxnNDbckrhrh9o2PIna/l82DGPwJoZNojCf8iwBxOhgIT&IR9Dk4=3fFxw
suspicious_features GET method with no useragent header suspicious_request GET http://www.imonbayazid.com/noha/?Mjn8dTK0=upOZ6PrAG2ZdtPD6bJdPoGjorbFnC14tHGvdg8pRXaHzyQfaZGuhGqEgmemzXeBkBYwm47js&IR9Dk4=3fFxw
suspicious_features GET method with no useragent header suspicious_request GET http://www.marketingtipsntricks.com/noha/?Mjn8dTK0=dXkK42TjkDV8ApElYKc3WklGy88ofVoxrIW43HxsKnt67+EPCV+CYMLG06Fj92qydxRY4T+w&IR9Dk4=3fFxw
suspicious_features GET method with no useragent header suspicious_request GET http://www.aodesai.store/noha/?Mjn8dTK0=jNXElFR2OtuqYf82LF4n3edstrWz0xOH2pdB2jawHl0j72O1VC8tvoT1rH57qzPmPpxD4Y+z&nfutZl=xPJDZDjp
request POST http://www.onlyforu14.rest/noha/
request GET http://www.onlyforu14.rest/noha/?Mjn8dTK0=P/l8qiYiqt8kvrDBUGtG7DlBr1gw3QxKROVjrB5CU3iUOyLfx1uglQZs8tc2Ej0fs967LZqC&IR9Dk4=3fFxw
request POST http://www.bois-applique.com/noha/
request GET http://www.bois-applique.com/noha/?Mjn8dTK0=bUhQERLpyNF3S/4WPZx/2yInVQcXiLPDhxdoMCXhoM+5+115cTKOZoaz7w3+FhRX4eW13PBz&IR9Dk4=3fFxw
request POST http://www.efficientmother.com/noha/
request GET http://www.efficientmother.com/noha/?Mjn8dTK0=Kn8BG0j13PT+fdehn0ecRK5TtgM7hEwDx6Ir9myzuy5hft3py86IuSi7z6NlkX23/IG2RvpY&IR9Dk4=3fFxw
request POST http://www.unarecord.com/noha/
request GET http://www.unarecord.com/noha/?Mjn8dTK0=YvZkpRzIvhyEmlzzRS448ue/J8Mk5cJYV8d0kFvUSx81G2wer5LDh4vokaiGyVzfr6bGhK1c&IR9Dk4=3fFxw
request POST http://www.standardizedsubmissions.com/noha/
request GET http://www.standardizedsubmissions.com/noha/?Mjn8dTK0=GK9Iij4dWGdWLGI8rL9KorDi156VJ86bzIwgF26pZJPilePG3H+sAuSIpYDMLu4exuJwhJUg&IR9Dk4=3fFxw
request POST http://www.artehamburguer.com/noha/
request GET http://www.artehamburguer.com/noha/?Mjn8dTK0=DIBCgQlqZpY9Thmaxf2kwZI9o6lnh3R5a85wuhZ9ARcS/yE4SOqWB+pyUDCzI4sO9p7f2GE3&IR9Dk4=3fFxw
request POST http://www.r2d2u.com/noha/
request GET http://www.r2d2u.com/noha/?Mjn8dTK0=ZqhtMyjM+olvYlg5E9e4KUZ/Rp6UxnNDbckrhrh9o2PIna/l82DGPwJoZNojCf8iwBxOhgIT&IR9Dk4=3fFxw
request POST http://www.imonbayazid.com/noha/
request GET http://www.imonbayazid.com/noha/?Mjn8dTK0=upOZ6PrAG2ZdtPD6bJdPoGjorbFnC14tHGvdg8pRXaHzyQfaZGuhGqEgmemzXeBkBYwm47js&IR9Dk4=3fFxw
request POST http://www.marketingtipsntricks.com/noha/
request GET http://www.marketingtipsntricks.com/noha/?Mjn8dTK0=dXkK42TjkDV8ApElYKc3WklGy88ofVoxrIW43HxsKnt67+EPCV+CYMLG06Fj92qydxRY4T+w&IR9Dk4=3fFxw
request POST http://www.aodesai.store/noha/
request GET http://www.aodesai.store/noha/?Mjn8dTK0=jNXElFR2OtuqYf82LF4n3edstrWz0xOH2pdB2jawHl0j72O1VC8tvoT1rH57qzPmPpxD4Y+z&nfutZl=xPJDZDjp
request POST http://www.onlyforu14.rest/noha/
request POST http://www.bois-applique.com/noha/
request POST http://www.efficientmother.com/noha/
request POST http://www.unarecord.com/noha/
request POST http://www.standardizedsubmissions.com/noha/
request POST http://www.artehamburguer.com/noha/
request POST http://www.r2d2u.com/noha/
request POST http://www.imonbayazid.com/noha/
request POST http://www.marketingtipsntricks.com/noha/
request POST http://www.aodesai.store/noha/
Time & API Arguments Status Return Repeated

NtProtectVirtualMemory

 process_identifier: 2948
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x728d2000
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2444
region_size: 3158016
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x00990000
allocation_type: 12288 (MEM_COMMIT|MEM_RESERVE)
process_handle: 0xffffffff
1 0 0
file C:\Users\test22\AppData\Local\Temp\nsx5FAE.tmp\bxbbuls.dll
file C:\Users\test22\AppData\Local\Temp\nsx5FAE.tmp\bxbbuls.dll
Time & API Arguments Status Return Repeated

LookupPrivilegeValueW

 system_name:
privilege_name: SeDebugPrivilege
1 1 0
Time & API Arguments Status Return Repeated

NtAllocateVirtualMemory

 process_identifier: 2444
region_size: 167936
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x00400000
allocation_type: 12288 (MEM_COMMIT|MEM_RESERVE)
process_handle: 0x00000228
1 0 0
Process injection Process 2948 called NtSetContextThread to modify thread in remote process 2444
Time & API Arguments Status Return Repeated

NtSetContextThread

 registers.eip: 2000355780
registers.esp: 1638384
registers.edi: 0
registers.eax: 4314256
registers.ebp: 0
registers.edx: 0
registers.ebx: 2130567168
registers.esi: 0
registers.ecx: 0
thread_handle: 0x00000224
process_identifier: 2444
1 0 0
Bkav W32.AIDetect.malware2
Lionic Trojan.Win32.Malicious.4!c
Elastic malicious (high confidence)
MicroWorld-eScan Trojan.NSISX.Spy.Gen.1
FireEye Generic.mg.9541217b4276268f
Cybereason malicious.b42762
Arcabit Trojan.NSISX.Spy.Gen.1
Cyren W32/Injector.AMI.gen!Eldorado
ESET-NOD32 a variant of Win32/Injector.EQFS
APEX Malicious
Paloalto generic.ml
Kaspersky UDS:Trojan-Spy.Win32.Noon.gen
BitDefender Trojan.NSISX.Spy.Gen.1
Sophos Mal/Generic-R
McAfee-GW-Edition BehavesLike.Win32.Dropper.dc
Emsisoft Trojan.NSISX.Spy.Gen.1 (B)
SentinelOne Static AI - Malicious PE
Microsoft Trojan:Win32/Formbook!MTB
GData Zum.Androm.1
Cynet Malicious (score: 100)
McAfee Artemis!9541217B4276
MAX malware (ai score=81)
Fortinet W32/Injector.EQFJ!tr
Time & API Arguments Status Return Repeated

CreateProcessInternalW

 thread_identifier: 2388
thread_handle: 0x00000224
process_identifier: 2444
current_directory:
filepath: C:\Users\test22\AppData\Local\Temp\mx.exe
track: 1
command_line: "C:\Users\test22\AppData\Local\Temp\mx.exe"
filepath_r: C:\Users\test22\AppData\Local\Temp\mx.exe
stack_pivoted: 0
creation_flags: 134217732 (CREATE_NO_WINDOW|CREATE_SUSPENDED)
inherit_handles: 0
process_handle: 0x00000228
1 1 0

NtGetContextThread

 thread_handle: 0x00000224
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2444
region_size: 167936
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x00400000
allocation_type: 12288 (MEM_COMMIT|MEM_RESERVE)
process_handle: 0x00000228
1 0 0

NtSetContextThread

 registers.eip: 2000355780
registers.esp: 1638384
registers.edi: 0
registers.eax: 4314256
registers.ebp: 0
registers.edx: 0
registers.ebx: 2130567168
registers.esi: 0
registers.ecx: 0
thread_handle: 0x00000224
process_identifier: 2444
1 0 0