Summary | ZeroBOX

Category	Machine	Started	Completed
FILE	s1_win7_x6401	Oct. 11, 2021, 9:52 a.m.	Oct. 11, 2021, 9:55 a.m.

Size	244.0KB
Type	PE32 executable (GUI) Intel 80386, for MS Windows, Nullsoft Installer self-extracting archive
MD5	`f93fe182b5ec5a3a1e343110b1ca22a0`
SHA256	`76891a7bc50be94f6c5ad4e10cbb3a6eb515d452e5bcf80efbde25d8b61d8607`
CRC32	`EB7DC97D`
ssdeep	`6144:F8LxBsSVduKhsAc54L+s4CYPFZlLi/+YH/vm:/GduK+IjEVLi//vm`
Yara	PE_Header_Zero - PE File Signature IsPE32 - (no description) Malicious_Library_Zero - Malicious_Library NSIS_Installer - Null Soft Installer

rundll32.exe "C:\Users\test22\AppData\Local\Temp\rundll32.exe"
1896

Name	Response	Post-Analysis Lookup
No hosts contacted.

IP Address	Status	Action
164.124.101.2	Active	Moloch

Suricata Alerts

No Suricata Alerts

Suricata TLS

No Suricata TLS

Checks amount of memory in system, this can be used to detect virtual machines that have a low amount of memory available (1 event)

Time & API	Arguments	Status	Return	Repeated
GlobalMemoryStatusEx Oct. 11, 2021, 9:52 a.m.		1	1	0

The executable contains unknown PE section names indicative of a packer (could be a false positive) (1 event)

section

.ndata

Allocates read-write-execute memory (usually to unpack itself) (23 events)

Time & API	Arguments	Status
NtProtectVirtualMemory Oct. 11, 2021, 9:52 a.m.	process_identifier: 1896 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x73d00000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Oct. 11, 2021, 9:52 a.m.	process_identifier: 1896 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x768d1000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Oct. 11, 2021, 9:52 a.m.	process_identifier: 1896 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x74e21000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Oct. 11, 2021, 9:52 a.m.	process_identifier: 1896 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x750f1000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Oct. 11, 2021, 9:52 a.m.	process_identifier: 1896 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x736e1000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Oct. 11, 2021, 9:52 a.m.	process_identifier: 1896 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x73cd1000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Oct. 11, 2021, 9:52 a.m.	process_identifier: 1896 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x73c91000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Oct. 11, 2021, 9:52 a.m.	process_identifier: 1896 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x74c41000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Oct. 11, 2021, 9:52 a.m.	process_identifier: 1896 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x729e1000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Oct. 11, 2021, 9:52 a.m.	process_identifier: 1896 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x729b1000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Oct. 11, 2021, 9:52 a.m.	process_identifier: 1896 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x74e51000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Oct. 11, 2021, 9:52 a.m.	process_identifier: 1896 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x728d1000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Oct. 11, 2021, 9:52 a.m.	process_identifier: 1896 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x727f1000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Oct. 11, 2021, 9:52 a.m.	process_identifier: 1896 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x727b4000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Oct. 11, 2021, 9:52 a.m.	process_identifier: 1896 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x727f2000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Oct. 11, 2021, 9:52 a.m.	process_identifier: 1896 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x73c71000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Oct. 11, 2021, 9:52 a.m.	process_identifier: 1896 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x765b1000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Oct. 11, 2021, 9:52 a.m.	process_identifier: 1896 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x72991000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Oct. 11, 2021, 9:52 a.m.	process_identifier: 1896 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x728b1000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Oct. 11, 2021, 9:52 a.m.	process_identifier: 1896 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x73c61000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Oct. 11, 2021, 9:52 a.m.	process_identifier: 1896 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x76891000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Oct. 11, 2021, 9:52 a.m.	process_identifier: 1896 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x72891000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Oct. 11, 2021, 9:52 a.m.	process_identifier: 1896 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x72641000 process_handle: 0xffffffff	1

Creates executable files on the filesystem (1 event)

file	C:\Users\test22\AppData\Local\Temp\nso63A5.tmp\ggmoe.dll

Drops an executable to the user AppData folder (1 event)

file	C:\Users\test22\AppData\Local\Temp\nso63A5.tmp\ggmoe.dll

Allocates execute permission to another process indicative of possible code injection (1 event)

Time & API	Arguments	Status	Return	Repeated
NtAllocateVirtualMemory Oct. 11, 2021, 9:52 a.m.	process_identifier: 1756 region_size: 229376 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00200000 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0x00000220	1	0	0

Creates a thread using CreateRemoteThread in a non-child process indicative of process injection (2 events)

Time & API	Arguments	Status	Return	Repeated
Process injection	Process 1896 created a remote thread in non-child process 1756
CreateRemoteThread Oct. 11, 2021, 9:52 a.m.	thread_identifier: 0 process_identifier: 1756 function_address: 0x0020717b flags: 4 stack_size: 0 parameter: 0x00000000 process_handle: 0x00000220	1	552	0

Manipulates memory of a non-child process indicative of process injection (2 events)

Time & API	Arguments	Status	Return	Repeated
Process injection	Process 1896 manipulating memory of non-child process 1756
NtAllocateVirtualMemory Oct. 11, 2021, 9:52 a.m.	process_identifier: 1756 region_size: 229376 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00200000 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0x00000220	1	0	0

File has been identified by 31 AntiVirus engines on VirusTotal as malicious (31 events)

Bkav	W32.AIDetect.malware2
Elastic	malicious (high confidence)
DrWeb	Trojan.PWS.Siggen2.51398
MicroWorld-eScan	Trojan.Generic.30364342
Sangfor	Suspicious.Win32.Save.a
Cyren	W32/Agent.DML.gen!Eldorado
Symantec	ML.Attribute.HighConfidence
ESET-NOD32	a variant of Win32/Injector.EQGK
APEX	Malicious
Kaspersky	HEUR:Trojan.Win32.Vobfus.gen
BitDefender	Trojan.Generic.30364342
Ad-Aware	Trojan.Generic.30364342
Sophos	Mal/Generic-S
McAfee-GW-Edition	BehavesLike.Win32.AdwareDotDo.dc
FireEye	Generic.mg.f93fe182b5ec5a3a
Emsisoft	Trojan.GenericKD.47137491 (B)
SentinelOne	Static AI - Malicious PE
Avira	TR/AD.Chapak.yhiez
MAX	malware (ai score=87)
Kingsoft	Win32.Troj.Generic_a.a.(kcloud)
Microsoft	Trojan:Win32/Tnega!ml
Arcabit	Trojan.Generic.D2CF42D3
ZoneAlarm	HEUR:Trojan.Win32.Vobfus.gen
GData	Win32.Trojan.OskiStealer.HQQRJQ
Cynet	Malicious (score: 100)
McAfee	Artemis!F93FE182B5EC
Panda	Trj/CI.A
Ikarus	Win32.Outbreak
Fortinet	W32/EQGK!tr
AVG	Win32:Malware-gen
Avast	Win32:Malware-gen

rundll32.exe

Process Tree Toggle all

Network Toggle all

Suricata Toggle all

Suricata Alerts

Suricata TLS

Signatures Toggle All