Summary | ZeroBOX

Category	Machine	Started	Completed
FILE	s1_win7_x6403_us	Oct. 26, 2021, 11:41 a.m.	Oct. 26, 2021, 11:43 a.m.

Size	1.2MB
Type	PE32 executable (GUI) Intel 80386, for MS Windows
MD5	`98c9398c958e6b0280c15108cde96186`
SHA256	`530e60117af681ba636ba03254c06041e865afa3f9cf1596ced6d59d58bdb1b8`
CRC32	`FA93191D`
ssdeep	`24576:u/7Xota4g42SAQL0UOEwNvQTZJwrG48dGSnrTv:nfAB3+ZJ7Gav`
Yara	Malicious_Packer_Zero - Malicious Packer PE_Header_Zero - PE File Signature IsPE32 - (no description) UPX_Zero - UPX packed file

service.exe "C:\Users\test22\AppData\Local\Temp\service.exe"
2396

Name	Response	Post-Analysis Lookup
No hosts contacted.

IP Address	Status	Action
164.124.101.2	Active	Moloch

Suricata Alerts

No Suricata Alerts

Suricata TLS

No Suricata TLS

One or more processes crashed (8 events)

Time & API	Arguments	Status
__exception__ Oct. 26, 2021, 11:42 a.m.	stacktrace: EbGetHandleOfExecutingProject+0x22b3 rtcPackDate-0xba9 msvbvm60+0xd0dcf @ 0x72a10dcf rtcDoEvents+0x131 __vbaError-0x626 msvbvm60+0xce228 @ 0x72a0e228 exception.instruction_r: c9 c2 10 00 cc cc cc cc cc 8b ff 55 8b ec 56 8b exception.symbol: RaiseException+0x58 CloseHandle-0x9 kernelbase+0xb727 exception.instruction: leave exception.module: KERNELBASE.dll exception.exception_code: 0xc000008f exception.offset: 46887 exception.address: 0x7677b727 registers.esp: 1636096 registers.edi: 6190784 registers.eax: 1636096 registers.ebp: 1636176 registers.edx: 0 registers.ebx: 6190784 registers.esi: 6190784 registers.ecx: 2	1
__exception__ Oct. 26, 2021, 11:42 a.m.	stacktrace: EbGetHandleOfExecutingProject+0x22b3 rtcPackDate-0xba9 msvbvm60+0xd0dcf @ 0x72a10dcf rtcDoEvents+0x131 __vbaError-0x626 msvbvm60+0xce228 @ 0x72a0e228 exception.instruction_r: c9 c2 10 00 cc cc cc cc cc 8b ff 55 8b ec 56 8b exception.symbol: RaiseException+0x58 CloseHandle-0x9 kernelbase+0xb727 exception.instruction: leave exception.module: KERNELBASE.dll exception.exception_code: 0xc000008f exception.offset: 46887 exception.address: 0x7677b727 registers.esp: 1636400 registers.edi: 1636588 registers.eax: 1636400 registers.ebp: 1636480 registers.edx: 0 registers.ebx: 6190784 registers.esi: 1636588 registers.ecx: 2	1
__exception__ Oct. 26, 2021, 11:42 a.m.	stacktrace: EbGetHandleOfExecutingProject+0x22b3 rtcPackDate-0xba9 msvbvm60+0xd0dcf @ 0x72a10dcf rtcDoEvents+0x131 __vbaError-0x626 msvbvm60+0xce228 @ 0x72a0e228 exception.instruction_r: c9 c2 10 00 cc cc cc cc cc 8b ff 55 8b ec 56 8b exception.symbol: RaiseException+0x58 CloseHandle-0x9 kernelbase+0xb727 exception.instruction: leave exception.module: KERNELBASE.dll exception.exception_code: 0xc000008f exception.offset: 46887 exception.address: 0x7677b727 registers.esp: 1636580 registers.edi: 1636768 registers.eax: 1636580 registers.ebp: 1636660 registers.edx: 0 registers.ebx: 6190784 registers.esi: 1636768 registers.ecx: 2	1
__exception__ Oct. 26, 2021, 11:42 a.m.	stacktrace: EbGetHandleOfExecutingProject+0x22b3 rtcPackDate-0xba9 msvbvm60+0xd0dcf @ 0x72a10dcf rtcDoEvents+0x131 __vbaError-0x626 msvbvm60+0xce228 @ 0x72a0e228 exception.instruction_r: c9 c2 10 00 cc cc cc cc cc 8b ff 55 8b ec 56 8b exception.symbol: RaiseException+0x58 CloseHandle-0x9 kernelbase+0xb727 exception.instruction: leave exception.module: KERNELBASE.dll exception.exception_code: 0xc000008f exception.offset: 46887 exception.address: 0x7677b727 registers.esp: 1636636 registers.edi: 1636824 registers.eax: 1636636 registers.ebp: 1636716 registers.edx: 0 registers.ebx: 6190784 registers.esi: 1636824 registers.ecx: 2	1
__exception__ Oct. 26, 2021, 11:42 a.m.	stacktrace: EbGetHandleOfExecutingProject+0x22b3 rtcPackDate-0xba9 msvbvm60+0xd0dcf @ 0x72a10dcf rtcDoEvents+0x131 __vbaError-0x626 msvbvm60+0xce228 @ 0x72a0e228 exception.instruction_r: c9 c2 10 00 cc cc cc cc cc 8b ff 55 8b ec 56 8b exception.symbol: RaiseException+0x58 CloseHandle-0x9 kernelbase+0xb727 exception.instruction: leave exception.module: KERNELBASE.dll exception.exception_code: 0xc000008f exception.offset: 46887 exception.address: 0x7677b727 registers.esp: 1636692 registers.edi: 1636880 registers.eax: 1636692 registers.ebp: 1636772 registers.edx: 0 registers.ebx: 6190784 registers.esi: 1636880 registers.ecx: 2	1
__exception__ Oct. 26, 2021, 11:42 a.m.	stacktrace: EbGetHandleOfExecutingProject+0x22b3 rtcPackDate-0xba9 msvbvm60+0xd0dcf @ 0x72a10dcf rtcDoEvents+0x131 __vbaError-0x626 msvbvm60+0xce228 @ 0x72a0e228 exception.instruction_r: c9 c2 10 00 cc cc cc cc cc 8b ff 55 8b ec 56 8b exception.symbol: RaiseException+0x58 CloseHandle-0x9 kernelbase+0xb727 exception.instruction: leave exception.module: KERNELBASE.dll exception.exception_code: 0xc000008f exception.offset: 46887 exception.address: 0x7677b727 registers.esp: 1636748 registers.edi: 1636936 registers.eax: 1636748 registers.ebp: 1636828 registers.edx: 0 registers.ebx: 6190784 registers.esi: 1636936 registers.ecx: 2	1
__exception__ Oct. 26, 2021, 11:42 a.m.	stacktrace: EbGetHandleOfExecutingProject+0x22b3 rtcPackDate-0xba9 msvbvm60+0xd0dcf @ 0x72a10dcf rtcDoEvents+0x131 __vbaError-0x626 msvbvm60+0xce228 @ 0x72a0e228 exception.instruction_r: c9 c2 10 00 cc cc cc cc cc 8b ff 55 8b ec 56 8b exception.symbol: RaiseException+0x58 CloseHandle-0x9 kernelbase+0xb727 exception.instruction: leave exception.module: KERNELBASE.dll exception.exception_code: 0xc000008f exception.offset: 46887 exception.address: 0x7677b727 registers.esp: 1636804 registers.edi: 1636992 registers.eax: 1636804 registers.ebp: 1636884 registers.edx: 0 registers.ebx: 6190784 registers.esi: 1636992 registers.ecx: 2	1
__exception__ Oct. 26, 2021, 11:42 a.m.	stacktrace: EbGetHandleOfExecutingProject+0x22b3 rtcPackDate-0xba9 msvbvm60+0xd0dcf @ 0x72a10dcf rtcDoEvents+0x131 __vbaError-0x626 msvbvm60+0xce228 @ 0x72a0e228 exception.instruction_r: c9 c2 10 00 cc cc cc cc cc 8b ff 55 8b ec 56 8b exception.symbol: RaiseException+0x58 CloseHandle-0x9 kernelbase+0xb727 exception.instruction: leave exception.module: KERNELBASE.dll exception.exception_code: 0xc000008f exception.offset: 46887 exception.address: 0x7677b727 registers.esp: 1634852 registers.edi: 6190784 registers.eax: 1634852 registers.ebp: 1634932 registers.edx: 0 registers.ebx: 6190784 registers.esi: 6190784 registers.ecx: 2	1

Foreign language identified in PE resource (3 events)

name

RT_STRING

language

LANG_LITHUANIAN

filetype

data

sublanguage

SUBLANG_LITHUANIAN_CLASSIC

offset

0x000c5690

size

0x0000008c

name

RT_STRING

language

LANG_LITHUANIAN

filetype

data

sublanguage

SUBLANG_LITHUANIAN_CLASSIC

offset

0x000c5690

size

0x0000008c

name

RT_STRING

language

LANG_LITHUANIAN

filetype

data

sublanguage

SUBLANG_LITHUANIAN_CLASSIC

offset

0x000c5690

size

0x0000008c

Changes read-write memory protection to read-execute (probably to avoid detection when setting all RWX flags at the same time) (1 event)

Time & API	Arguments	Status	Return	Repeated
NtProtectVirtualMemory Oct. 26, 2021, 11:41 a.m.	process_identifier: 2396 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 length: 24576 protection: 32 (PAGE_EXECUTE_READ) base_address: 0x003f0000 process_handle: 0xffffffff	1	0	0

File has been identified by 23 AntiVirus engines on VirusTotal as malicious (23 events)

Bkav	W32.AIDetect.malware2
Elastic	malicious (high confidence)
MicroWorld-eScan	Trojan.GenericKD.47248044
FireEye	Generic.mg.98c9398c958e6b02
Cylance	Unsafe
Sangfor	Trojan.Win32.Save.a
Cybereason	malicious.8c6126
Cyren	W32/VB_Troj.CM.gen!Eldorado
Symantec	ML.Attribute.HighConfidence
ESET-NOD32	a variant of Win32/GenKryptik.FMNQ
APEX	Malicious
Kaspersky	Trojan.Win32.Injuke.eypd
BitDefender	Trojan.GenericKD.47248044
Ad-Aware	Trojan.GenericKD.47248044
Emsisoft	Trojan.GenericKD.47248044 (B)
DrWeb	Trojan.VbCrypt.250
Microsoft	Trojan:Win32/Sabsik.FL.B!ml
GData	Trojan.GenericKD.47248044
Cynet	Malicious (score: 100)
BitDefenderTheta	Gen:NN.ZevbaF.34236.nn3@auSeGiiO
MAX	malware (ai score=81)
SentinelOne	Static AI - Malicious PE
CrowdStrike	win/malicious_confidence_100% (W)

service.exe

Process Tree Toggle all

Network Toggle all

Suricata Toggle all

Suricata Alerts

Suricata TLS

Signatures Toggle All