Summary | ZeroBOX

Category	Machine	Started	Completed
FILE	s1_win7_x6401	Oct. 26, 2021, 11:41 a.m.	Oct. 26, 2021, 11:45 a.m.

Size	1.4MB
Type	PE32 executable (GUI) Intel 80386, for MS Windows
MD5	`f88c058646225de6e3cddc39ea0c9ff7`
SHA256	`8dca2819e4395eb497f4246dc808a5efb1cd805a70825bda636240facd8dd66c`
CRC32	`A8278EE8`
ssdeep	`24576:N/7Xota4g42SAQExHGz4yjERgvN00n6WoNrn:OfExHGz4yj+gvN00n6WoNrn`
Yara	Malicious_Packer_Zero - Malicious Packer PE_Header_Zero - PE File Signature IsPE32 - (no description) UPX_Zero - UPX packed file

dwm.exe "C:\Users\test22\AppData\Local\Temp\dwm.exe"
1108

Name	Response	Post-Analysis Lookup
No hosts contacted.

IP Address	Status	Action
164.124.101.2	Active	Moloch

Suricata Alerts

No Suricata Alerts

Suricata TLS

No Suricata TLS

One or more processes crashed (8 events)

Time & API	Arguments	Status
__exception__ Oct. 26, 2021, 11:42 a.m.	stacktrace: EbGetHandleOfExecutingProject+0x22b3 rtcPackDate-0xba9 msvbvm60+0xd0dcf @ 0x72a10dcf rtcDoEvents+0x131 __vbaError-0x626 msvbvm60+0xce228 @ 0x72a0e228 exception.instruction_r: c9 c2 10 00 cc cc cc cc cc 8b ff 55 8b ec 56 8b exception.symbol: RaiseException+0x58 CloseHandle-0x9 kernelbase+0xb727 exception.instruction: leave exception.module: KERNELBASE.dll exception.exception_code: 0xc000008f exception.offset: 46887 exception.address: 0x76a7b727 registers.esp: 1636096 registers.edi: 3163736 registers.eax: 1636096 registers.ebp: 1636176 registers.edx: 0 registers.ebx: 3163736 registers.esi: 3163736 registers.ecx: 2	1
__exception__ Oct. 26, 2021, 11:42 a.m.	stacktrace: EbGetHandleOfExecutingProject+0x22b3 rtcPackDate-0xba9 msvbvm60+0xd0dcf @ 0x72a10dcf rtcDoEvents+0x131 __vbaError-0x626 msvbvm60+0xce228 @ 0x72a0e228 exception.instruction_r: c9 c2 10 00 cc cc cc cc cc 8b ff 55 8b ec 56 8b exception.symbol: RaiseException+0x58 CloseHandle-0x9 kernelbase+0xb727 exception.instruction: leave exception.module: KERNELBASE.dll exception.exception_code: 0xc000008f exception.offset: 46887 exception.address: 0x76a7b727 registers.esp: 1636400 registers.edi: 1636588 registers.eax: 1636400 registers.ebp: 1636480 registers.edx: 0 registers.ebx: 3163736 registers.esi: 1636588 registers.ecx: 2	1
__exception__ Oct. 26, 2021, 11:42 a.m.	stacktrace: EbGetHandleOfExecutingProject+0x22b3 rtcPackDate-0xba9 msvbvm60+0xd0dcf @ 0x72a10dcf rtcDoEvents+0x131 __vbaError-0x626 msvbvm60+0xce228 @ 0x72a0e228 exception.instruction_r: c9 c2 10 00 cc cc cc cc cc 8b ff 55 8b ec 56 8b exception.symbol: RaiseException+0x58 CloseHandle-0x9 kernelbase+0xb727 exception.instruction: leave exception.module: KERNELBASE.dll exception.exception_code: 0xc000008f exception.offset: 46887 exception.address: 0x76a7b727 registers.esp: 1636580 registers.edi: 1636768 registers.eax: 1636580 registers.ebp: 1636660 registers.edx: 0 registers.ebx: 3163736 registers.esi: 1636768 registers.ecx: 2	1
__exception__ Oct. 26, 2021, 11:42 a.m.	stacktrace: EbGetHandleOfExecutingProject+0x22b3 rtcPackDate-0xba9 msvbvm60+0xd0dcf @ 0x72a10dcf rtcDoEvents+0x131 __vbaError-0x626 msvbvm60+0xce228 @ 0x72a0e228 exception.instruction_r: c9 c2 10 00 cc cc cc cc cc 8b ff 55 8b ec 56 8b exception.symbol: RaiseException+0x58 CloseHandle-0x9 kernelbase+0xb727 exception.instruction: leave exception.module: KERNELBASE.dll exception.exception_code: 0xc000008f exception.offset: 46887 exception.address: 0x76a7b727 registers.esp: 1636636 registers.edi: 1636824 registers.eax: 1636636 registers.ebp: 1636716 registers.edx: 0 registers.ebx: 3163736 registers.esi: 1636824 registers.ecx: 2	1
__exception__ Oct. 26, 2021, 11:42 a.m.	stacktrace: EbGetHandleOfExecutingProject+0x22b3 rtcPackDate-0xba9 msvbvm60+0xd0dcf @ 0x72a10dcf rtcDoEvents+0x131 __vbaError-0x626 msvbvm60+0xce228 @ 0x72a0e228 exception.instruction_r: c9 c2 10 00 cc cc cc cc cc 8b ff 55 8b ec 56 8b exception.symbol: RaiseException+0x58 CloseHandle-0x9 kernelbase+0xb727 exception.instruction: leave exception.module: KERNELBASE.dll exception.exception_code: 0xc000008f exception.offset: 46887 exception.address: 0x76a7b727 registers.esp: 1636692 registers.edi: 1636880 registers.eax: 1636692 registers.ebp: 1636772 registers.edx: 0 registers.ebx: 3163736 registers.esi: 1636880 registers.ecx: 2	1
__exception__ Oct. 26, 2021, 11:42 a.m.	stacktrace: EbGetHandleOfExecutingProject+0x22b3 rtcPackDate-0xba9 msvbvm60+0xd0dcf @ 0x72a10dcf rtcDoEvents+0x131 __vbaError-0x626 msvbvm60+0xce228 @ 0x72a0e228 exception.instruction_r: c9 c2 10 00 cc cc cc cc cc 8b ff 55 8b ec 56 8b exception.symbol: RaiseException+0x58 CloseHandle-0x9 kernelbase+0xb727 exception.instruction: leave exception.module: KERNELBASE.dll exception.exception_code: 0xc000008f exception.offset: 46887 exception.address: 0x76a7b727 registers.esp: 1636748 registers.edi: 1636936 registers.eax: 1636748 registers.ebp: 1636828 registers.edx: 0 registers.ebx: 3163736 registers.esi: 1636936 registers.ecx: 2	1
__exception__ Oct. 26, 2021, 11:42 a.m.	stacktrace: EbGetHandleOfExecutingProject+0x22b3 rtcPackDate-0xba9 msvbvm60+0xd0dcf @ 0x72a10dcf rtcDoEvents+0x131 __vbaError-0x626 msvbvm60+0xce228 @ 0x72a0e228 exception.instruction_r: c9 c2 10 00 cc cc cc cc cc 8b ff 55 8b ec 56 8b exception.symbol: RaiseException+0x58 CloseHandle-0x9 kernelbase+0xb727 exception.instruction: leave exception.module: KERNELBASE.dll exception.exception_code: 0xc000008f exception.offset: 46887 exception.address: 0x76a7b727 registers.esp: 1636804 registers.edi: 1636992 registers.eax: 1636804 registers.ebp: 1636884 registers.edx: 0 registers.ebx: 3163736 registers.esi: 1636992 registers.ecx: 2	1
__exception__ Oct. 26, 2021, 11:43 a.m.	stacktrace: EbGetHandleOfExecutingProject+0x22b3 rtcPackDate-0xba9 msvbvm60+0xd0dcf @ 0x72a10dcf rtcDoEvents+0x131 __vbaError-0x626 msvbvm60+0xce228 @ 0x72a0e228 exception.instruction_r: c9 c2 10 00 cc cc cc cc cc 8b ff 55 8b ec 56 8b exception.symbol: RaiseException+0x58 CloseHandle-0x9 kernelbase+0xb727 exception.instruction: leave exception.module: KERNELBASE.dll exception.exception_code: 0xc000008f exception.offset: 46887 exception.address: 0x76a7b727 registers.esp: 1634852 registers.edi: 3163736 registers.eax: 1634852 registers.ebp: 1634932 registers.edx: 0 registers.ebx: 3163736 registers.esi: 3163736 registers.ecx: 2	1

Allocates read-write-execute memory (usually to unpack itself) (1 event)

Time & API	Arguments	Status	Return	Repeated
NtProtectVirtualMemory Oct. 26, 2021, 11:41 a.m.	process_identifier: 1108 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x72d72000 process_handle: 0xffffffff	1	0	0

Foreign language identified in PE resource (3 events)

name

RT_STRING

language

LANG_LITHUANIAN

filetype

data

sublanguage

SUBLANG_LITHUANIAN_CLASSIC

offset

0x000f1a24

size

0x0000008c

name

RT_STRING

language

LANG_LITHUANIAN

filetype

data

sublanguage

SUBLANG_LITHUANIAN_CLASSIC

offset

0x000f1a24

size

0x0000008c

name

RT_STRING

language

LANG_LITHUANIAN

filetype

data

sublanguage

SUBLANG_LITHUANIAN_CLASSIC

offset

0x000f1a24

size

0x0000008c

Changes read-write memory protection to read-execute (probably to avoid detection when setting all RWX flags at the same time) (1 event)

Time & API	Arguments	Status	Return	Repeated
NtProtectVirtualMemory Oct. 26, 2021, 11:41 a.m.	process_identifier: 1108 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 length: 24576 protection: 32 (PAGE_EXECUTE_READ) base_address: 0x005e0000 process_handle: 0xffffffff	1	0	0

File has been identified by 29 AntiVirus engines on VirusTotal as malicious (29 events)

Lionic	Trojan.Win32.Bsymem.4!c
Elastic	malicious (high confidence)
DrWeb	Trojan.VbCrypt.250
MicroWorld-eScan	Trojan.GenericKD.37864277
FireEye	Generic.mg.f88c058646225de6
ALYac	Trojan.GenericKD.37864277
Cylance	Unsafe
Sangfor	Trojan.Win32.Save.a
Cybereason	malicious.b49ee8
BitDefenderTheta	Gen:NN.ZevbaF.34236.yn3@a0TxMzfO
Cyren	W32/VBKrypt.BCK.gen!Eldorado
Symantec	ML.Attribute.HighConfidence
ESET-NOD32	a variant of Win32/GenKryptik.FMNQ
APEX	Malicious
Paloalto	generic.ml
Kaspersky	Trojan.Win32.Bsymem.adpg
BitDefender	Trojan.GenericKD.37864277
Avast	FileRepMalware
Tencent	Win32.Trojan.Bsymem.Eehg
Ad-Aware	Trojan.GenericKD.37864277
Sophos	Mal/Generic-S
McAfee-GW-Edition	BehavesLike.Win32.Generic.th
Emsisoft	Trojan.GenericKD.37864277 (B)
MAX	malware (ai score=82)
Microsoft	Trojan:Win32/Sabsik.FL.B!ml
GData	Trojan.GenericKD.37864277
McAfee	Artemis!F88C05864622
AVG	FileRepMalware
CrowdStrike	win/malicious_confidence_100% (W)

dwm.exe

Process Tree Toggle all

Network Toggle all

Suricata Toggle all

Suricata Alerts

Suricata TLS

Signatures Toggle All