popup
Summary | ZeroBOX
  1. Home
  2. Result
  3. Report
  4. Detail Analysis

vpn.exe

Gen1 Generic Malware Malicious Library Admin Tool (Sysinternals etc ...) UPX Malicious Packer PE64 PNG Format PE File OS Processor Check PE32 DLL
  1. Resubmit sample
Category Machine Started Completed
FILE s1_win7_x6403_us Oct. 26, 2021, 1:39 p.m. Oct. 26, 2021, 1:43 p.m.
Size 15.0MB
Type PE32 executable (GUI) Intel 80386, for MS Windows
MD5 4dd57eb8ea614ca43e679abeaf5351bf
SHA256 90344efa69152166a3f894cbd0a41640a6bbbe9053a80585d2e98906ff74f44b
CRC32 2D2162C1
ssdeep 393216:+fAlhvR8PZ5ECts3Rztsr5PSL0g7+Pgkt7/7xU5:rlhv2O1tfZi7/FG
Yara
  • PE_Header_Zero - PE File Signature
  • IsPE32 - (no description)
  • Malicious_Library_Zero - Malicious_Library
  • UPX_Zero - UPX packed file

Name Response Post-Analysis Lookup
No hosts contacted.
IP Address Status Action
No hosts contacted.

Suricata Alerts

No Suricata Alerts

Suricata TLS

No Suricata TLS

Time & API Arguments Status Return Repeated

IsDebuggerPresent

 0 0
section .itext
Time & API Arguments Status Return Repeated

NtProtectVirtualMemory

 process_identifier: 2408
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x00400000
process_handle: 0xffffffff
1 0 0

NtProtectVirtualMemory

 process_identifier: 2408
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 90112
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x00401000
process_handle: 0xffffffff
1 0 0

NtProtectVirtualMemory

 process_identifier: 2408
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 180224
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x00420000
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2492
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x003a0000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2492
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x022d0000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtProtectVirtualMemory

 process_identifier: 2492
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x07a50000
process_handle: 0xffffffff
1 0 0

NtProtectVirtualMemory

 process_identifier: 2492
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x07a50000
process_handle: 0xffffffff
1 0 0

NtProtectVirtualMemory

 process_identifier: 2492
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x07a50000
process_handle: 0xffffffff
1 0 0

NtProtectVirtualMemory

 process_identifier: 2492
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x07a50000
process_handle: 0xffffffff
1 0 0

NtProtectVirtualMemory

 process_identifier: 2492
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x07a50000
process_handle: 0xffffffff
1 0 0

NtProtectVirtualMemory

 process_identifier: 2492
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x07a50000
process_handle: 0xffffffff
1 0 0

NtProtectVirtualMemory

 process_identifier: 2492
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x07a50000
process_handle: 0xffffffff
1 0 0

NtProtectVirtualMemory

 process_identifier: 2492
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x07a50000
process_handle: 0xffffffff
1 0 0
file C:\Users\test22\AppData\Local\Temp\is-B4S06.tmp\botva2.dll
file C:\Users\test22\AppData\Local\Temp\is-B4S06.tmp\InnoCallback.dll
file C:\Users\test22\AppData\Local\Temp\is-B4S06.tmp\_isetup\_shfoldr.dll
file C:\Users\test22\AppData\Local\Temp\is-B4S06.tmp\libMaskVPN.dll
file C:\Users\test22\AppData\Local\Temp\is-B4S06.tmp\ApiTool.dll
file C:\Users\test22\AppData\Local\Temp\is-B4S06.tmp\InnoCallback.dll
file C:\Users\test22\AppData\Local\Temp\is-B4S06.tmp\botva2.dll
file C:\Users\test22\AppData\Local\Temp\is-DTEC7.tmp\vpn.tmp
file C:\Users\test22\AppData\Local\Temp\is-B4S06.tmp\_isetup\_shfoldr.dll
file C:\Users\test22\AppData\Local\Temp\is-B4S06.tmp\libMaskVPN.dll
file C:\Users\test22\AppData\Local\Temp\is-B4S06.tmp\ApiTool.dll
DrWeb Adware.AdExpertsMedia.3
ESET-NOD32 a variant of Win32/Adware.AdExpertsMedia.A
Time & API Arguments Status Return Repeated

LookupPrivilegeValueW

 system_name:
privilege_name: SeDebugPrivilege
1 1 0
Time & API Arguments Status Return Repeated

RegOpenKeyExW

 regkey_r: Software\Microsoft\Windows\CurrentVersion\Uninstall\{4A4ACF2E-4A98-4D18-80E3-5A5E5706F81E}_is1
base_handle: 0x80000001
key_handle: 0x00000000
options: 0
access: 0x00000001
regkey: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Uninstall\{4A4ACF2E-4A98-4D18-80E3-5A5E5706F81E}_is1
2 0

RegOpenKeyExW

 regkey_r: Software\Microsoft\Windows\CurrentVersion\Uninstall\{4A4ACF2E-4A98-4D18-80E3-5A5E5706F81E}_is1
base_handle: 0x80000002
key_handle: 0x00000000
options: 0
access: 0x00000001
regkey: HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Uninstall\{4A4ACF2E-4A98-4D18-80E3-5A5E5706F81E}_is1
2 0

RegOpenKeyExW

 regkey_r: SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{4A4ACF2E-4A98-4D18-80E3-5A5E5706F81E}_is1
base_handle: 0x80000002
key_handle: 0x00000000
options: 0
access: 0x00000001
regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{4A4ACF2E-4A98-4D18-80E3-5A5E5706F81E}_is1
2 0