popup
Summary | ZeroBOX
  1. Home
  2. Result
  3. Report
  4. Detail Analysis

winlogon.exe

NSIS Malicious Library UPX PE File DLL OS Processor Check PE32
  1. Resubmit sample
Category Machine Started Completed
FILE s1_win7_x6401 Nov. 2, 2021, 12:12 p.m. Nov. 2, 2021, 12:29 p.m.
Size 476.6KB
Type PE32 executable (GUI) Intel 80386, for MS Windows, Nullsoft Installer self-extracting archive
MD5 fd06b68ee03940e334f35b12e36ac718
SHA256 d0d08195d6779cadf6750741740960f4956110f505a63c1109427449df51b13e
CRC32 3E5324E2
ssdeep 12288:GgFHH+HHHHHWHVHCUXGHnHHhHraH9HMx9SZWLR1eXOuMtI5GZ29+aB3qcn5rOdNZ:pFHH+HHHHHWHVHCUXGHnHHhHraHeeXOl
Yara
  • PE_Header_Zero - PE File Signature
  • IsPE32 - (no description)
  • Malicious_Library_Zero - Malicious_Library
  • UPX_Zero - UPX packed file
  • NSIS_Installer - Null Soft Installer

Suricata Alerts

Flow SID Signature Category
TCP 192.168.56.101:49165 -> 182.50.132.242:80 2031412 ET MALWARE FormBook CnC Checkin (GET) Malware Command and Control Activity Detected
TCP 192.168.56.101:49165 -> 182.50.132.242:80 2031449 ET MALWARE FormBook CnC Checkin (GET) Malware Command and Control Activity Detected
TCP 192.168.56.101:49165 -> 182.50.132.242:80 2031453 ET MALWARE FormBook CnC Checkin (GET) Malware Command and Control Activity Detected
TCP 192.168.56.101:49167 -> 34.102.136.180:80 2031412 ET MALWARE FormBook CnC Checkin (GET) Malware Command and Control Activity Detected
TCP 192.168.56.101:49167 -> 34.102.136.180:80 2031449 ET MALWARE FormBook CnC Checkin (GET) Malware Command and Control Activity Detected
TCP 192.168.56.101:49167 -> 34.102.136.180:80 2031453 ET MALWARE FormBook CnC Checkin (GET) Malware Command and Control Activity Detected
TCP 192.168.56.101:49168 -> 172.67.179.126:80 2031412 ET MALWARE FormBook CnC Checkin (GET) Malware Command and Control Activity Detected
TCP 192.168.56.101:49168 -> 172.67.179.126:80 2031449 ET MALWARE FormBook CnC Checkin (GET) Malware Command and Control Activity Detected
TCP 192.168.56.101:49168 -> 172.67.179.126:80 2031453 ET MALWARE FormBook CnC Checkin (GET) Malware Command and Control Activity Detected
TCP 192.168.56.101:49175 -> 34.102.136.180:80 2031412 ET MALWARE FormBook CnC Checkin (GET) Malware Command and Control Activity Detected
TCP 192.168.56.101:49175 -> 34.102.136.180:80 2031449 ET MALWARE FormBook CnC Checkin (GET) Malware Command and Control Activity Detected
TCP 192.168.56.101:49175 -> 34.102.136.180:80 2031453 ET MALWARE FormBook CnC Checkin (GET) Malware Command and Control Activity Detected
TCP 192.168.56.101:49169 -> 52.147.15.202:80 2031412 ET MALWARE FormBook CnC Checkin (GET) Malware Command and Control Activity Detected
TCP 192.168.56.101:49169 -> 52.147.15.202:80 2031449 ET MALWARE FormBook CnC Checkin (GET) Malware Command and Control Activity Detected
TCP 192.168.56.101:49169 -> 52.147.15.202:80 2031453 ET MALWARE FormBook CnC Checkin (GET) Malware Command and Control Activity Detected
TCP 192.168.56.101:49172 -> 172.81.119.116:80 2031412 ET MALWARE FormBook CnC Checkin (GET) Malware Command and Control Activity Detected
TCP 192.168.56.101:49172 -> 172.81.119.116:80 2031449 ET MALWARE FormBook CnC Checkin (GET) Malware Command and Control Activity Detected
TCP 192.168.56.101:49172 -> 172.81.119.116:80 2031453 ET MALWARE FormBook CnC Checkin (GET) Malware Command and Control Activity Detected
TCP 192.168.56.101:49176 -> 172.81.119.116:80 2031412 ET MALWARE FormBook CnC Checkin (GET) Malware Command and Control Activity Detected
TCP 192.168.56.101:49176 -> 172.81.119.116:80 2031449 ET MALWARE FormBook CnC Checkin (GET) Malware Command and Control Activity Detected
TCP 192.168.56.101:49176 -> 172.81.119.116:80 2031453 ET MALWARE FormBook CnC Checkin (GET) Malware Command and Control Activity Detected
TCP 192.168.56.101:49174 -> 34.102.136.180:80 2031412 ET MALWARE FormBook CnC Checkin (GET) Malware Command and Control Activity Detected
TCP 192.168.56.101:49174 -> 34.102.136.180:80 2031449 ET MALWARE FormBook CnC Checkin (GET) Malware Command and Control Activity Detected
TCP 192.168.56.101:49174 -> 34.102.136.180:80 2031453 ET MALWARE FormBook CnC Checkin (GET) Malware Command and Control Activity Detected
TCP 192.168.56.101:49171 -> 198.54.117.212:80 2031412 ET MALWARE FormBook CnC Checkin (GET) Malware Command and Control Activity Detected
TCP 192.168.56.101:49171 -> 198.54.117.212:80 2031449 ET MALWARE FormBook CnC Checkin (GET) Malware Command and Control Activity Detected
TCP 192.168.56.101:49171 -> 198.54.117.212:80 2031453 ET MALWARE FormBook CnC Checkin (GET) Malware Command and Control Activity Detected
TCP 192.168.56.101:49173 -> 198.54.115.202:80 2031412 ET MALWARE FormBook CnC Checkin (GET) Malware Command and Control Activity Detected
TCP 192.168.56.101:49173 -> 198.54.115.202:80 2031449 ET MALWARE FormBook CnC Checkin (GET) Malware Command and Control Activity Detected
TCP 192.168.56.101:49173 -> 198.54.115.202:80 2031453 ET MALWARE FormBook CnC Checkin (GET) Malware Command and Control Activity Detected
TCP 192.168.56.101:49170 -> 35.75.36.192:80 2031412 ET MALWARE FormBook CnC Checkin (GET) Malware Command and Control Activity Detected
TCP 192.168.56.101:49170 -> 35.75.36.192:80 2031449 ET MALWARE FormBook CnC Checkin (GET) Malware Command and Control Activity Detected
TCP 192.168.56.101:49170 -> 35.75.36.192:80 2031453 ET MALWARE FormBook CnC Checkin (GET) Malware Command and Control Activity Detected
TCP 192.168.56.101:49166 -> 44.227.65.245:80 2031412 ET MALWARE FormBook CnC Checkin (GET) Malware Command and Control Activity Detected
TCP 192.168.56.101:49166 -> 44.227.65.245:80 2031449 ET MALWARE FormBook CnC Checkin (GET) Malware Command and Control Activity Detected
TCP 192.168.56.101:49166 -> 44.227.65.245:80 2031453 ET MALWARE FormBook CnC Checkin (GET) Malware Command and Control Activity Detected
TCP 192.168.56.101:49166 -> 44.227.65.245:80 2031088 ET HUNTING Request to .XYZ Domain with Minimal Headers Potentially Bad Traffic

Suricata TLS

No Suricata TLS

Time & API Arguments Status Return Repeated

GlobalMemoryStatusEx

 1 1 0
section .ndata
suspicious_features GET method with no useragent header suspicious_request GET http://www.lighthouseta.com/sywu/?w6A=Fif6t9qBJS7PfbW+nV4zZIDOtUBpWKOdgsWufsEgrcVkaPOFX3rA+XhOwSnXgM/wsAdsDFIh&-ZP=W6O83na8w
suspicious_features GET method with no useragent header suspicious_request GET http://www.kisah.xyz/sywu/?w6A=USn/s/Nw3xV+55U0SZdH7vYZi5cG3dzFHZRqO94C2q7bkP8vqLkNejL861JCezwhEQy9FwbC&-ZP=W6O83na8w
suspicious_features GET method with no useragent header suspicious_request GET http://www.hackensacksalon.com/sywu/?w6A=Mnq1bqiC49iBnkdWSYwkyTPzzdMFp6JEYXjvu8mvu3uFvmJ8P1TzqjsOhyyHXjE1E7yueDxs&-ZP=W6O83na8w
suspicious_features GET method with no useragent header suspicious_request GET http://www.thesavingsplaceforseniors.com/sywu/?w6A=iu47MEIDrgQO/UeWdsS4BFh94hPqX44shOdUJcCg7IkYfjAuxHXRq+jyqsiavnN3/bE4kK6e&-ZP=W6O83na8w
suspicious_features GET method with no useragent header suspicious_request GET http://www.38leckiestreet.com/sywu/?w6A=/vgTM4p9Z9iBgidmSY6A4cWY0D0pZxvvQpGDn6K72F4Gd8RLtU+z71PJ62L3W5IEhfgKqCPr&-ZP=W6O83na8w
suspicious_features GET method with no useragent header suspicious_request GET http://www.gengzicompute.com/sywu/?w6A=Sg/J+PD4SKoqXgcmmzEPzbkHChriOJdDtNPl57LzzQHkFhA1i4k5hjYuVkkFWhs3HT30LL4x&-ZP=W6O83na8w
suspicious_features GET method with no useragent header suspicious_request GET http://www.pheasa.com/sywu/?w6A=BQWKLZqyrMJ7eqH6IGBOhz3kcEiVnMegmaSI8UN/kuWh4tWV0X7oy/aezhN+nJAS1pBTDNxh&-ZP=W6O83na8w
suspicious_features GET method with no useragent header suspicious_request GET http://www.mikes-marine.com/sywu/?w6A=PbabmpsWFdXWMNTeeZ9jCNWPOn1z0XvHeI08BocNs8nNIG8Ni599zrxFdxp3gdzeKqca/8nw&-ZP=W6O83na8w
suspicious_features GET method with no useragent header suspicious_request GET http://www.domagolf.net/sywu/?w6A=pWCHhwZSB8QVaKAXyXHQ/feWfa0gotZo+yd5m/ANfGhLPfzR5bnQsT+hTkJWfzwyKFh8K9io&-ZP=W6O83na8w
suspicious_features GET method with no useragent header suspicious_request GET http://www.brieffinance.com/sywu/?w6A=79IAT+ehqG9gcLZadmU6oVO+UoItJgESjXslc308jYls3X8IJdNNO8prg0K9Trpv14OhLbhs&-ZP=W6O83na8w
suspicious_features GET method with no useragent header suspicious_request GET http://www.greentonnage.info/sywu/?w6A=31AjcD+O/vkoDfHT81xlOZAWORGDp8vMbh6MjaA+OZmTL3IFlsvupoNvu11kki8t5+GWmUSf&-ZP=W6O83na8w
suspicious_features GET method with no useragent header suspicious_request GET http://www.mikes-marine.com/sywu/?w6A=PbabmpsWFdXWMNTeeZ9jCNWPOn1z0XvHeI08BocNs8nNIG8Ni599zrxFdxp3gdzeKqca/8nw&YL0=9rN46F
request GET http://www.lighthouseta.com/sywu/?w6A=Fif6t9qBJS7PfbW+nV4zZIDOtUBpWKOdgsWufsEgrcVkaPOFX3rA+XhOwSnXgM/wsAdsDFIh&-ZP=W6O83na8w
request GET http://www.kisah.xyz/sywu/?w6A=USn/s/Nw3xV+55U0SZdH7vYZi5cG3dzFHZRqO94C2q7bkP8vqLkNejL861JCezwhEQy9FwbC&-ZP=W6O83na8w
request GET http://www.hackensacksalon.com/sywu/?w6A=Mnq1bqiC49iBnkdWSYwkyTPzzdMFp6JEYXjvu8mvu3uFvmJ8P1TzqjsOhyyHXjE1E7yueDxs&-ZP=W6O83na8w
request GET http://www.thesavingsplaceforseniors.com/sywu/?w6A=iu47MEIDrgQO/UeWdsS4BFh94hPqX44shOdUJcCg7IkYfjAuxHXRq+jyqsiavnN3/bE4kK6e&-ZP=W6O83na8w
request GET http://www.38leckiestreet.com/sywu/?w6A=/vgTM4p9Z9iBgidmSY6A4cWY0D0pZxvvQpGDn6K72F4Gd8RLtU+z71PJ62L3W5IEhfgKqCPr&-ZP=W6O83na8w
request GET http://www.gengzicompute.com/sywu/?w6A=Sg/J+PD4SKoqXgcmmzEPzbkHChriOJdDtNPl57LzzQHkFhA1i4k5hjYuVkkFWhs3HT30LL4x&-ZP=W6O83na8w
request GET http://www.pheasa.com/sywu/?w6A=BQWKLZqyrMJ7eqH6IGBOhz3kcEiVnMegmaSI8UN/kuWh4tWV0X7oy/aezhN+nJAS1pBTDNxh&-ZP=W6O83na8w
request GET http://www.mikes-marine.com/sywu/?w6A=PbabmpsWFdXWMNTeeZ9jCNWPOn1z0XvHeI08BocNs8nNIG8Ni599zrxFdxp3gdzeKqca/8nw&-ZP=W6O83na8w
request GET http://www.domagolf.net/sywu/?w6A=pWCHhwZSB8QVaKAXyXHQ/feWfa0gotZo+yd5m/ANfGhLPfzR5bnQsT+hTkJWfzwyKFh8K9io&-ZP=W6O83na8w
request GET http://www.brieffinance.com/sywu/?w6A=79IAT+ehqG9gcLZadmU6oVO+UoItJgESjXslc308jYls3X8IJdNNO8prg0K9Trpv14OhLbhs&-ZP=W6O83na8w
request GET http://www.greentonnage.info/sywu/?w6A=31AjcD+O/vkoDfHT81xlOZAWORGDp8vMbh6MjaA+OZmTL3IFlsvupoNvu11kki8t5+GWmUSf&-ZP=W6O83na8w
request GET http://www.mikes-marine.com/sywu/?w6A=PbabmpsWFdXWMNTeeZ9jCNWPOn1z0XvHeI08BocNs8nNIG8Ni599zrxFdxp3gdzeKqca/8nw&YL0=9rN46F
Time & API Arguments Status Return Repeated

NtProtectVirtualMemory

 process_identifier: 2768
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x739e2000
process_handle: 0xffffffff
1 0 0

NtProtectVirtualMemory

 process_identifier: 2768
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 8192
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x74306000
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2880
region_size: 3158016
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x007e0000
allocation_type: 12288 (MEM_COMMIT|MEM_RESERVE)
process_handle: 0xffffffff
1 0 0
file C:\Users\test22\AppData\Local\Temp\nsfE1F4.tmp\ijgqmzc.dll
file C:\Users\test22\AppData\Local\Temp\nsfE1F4.tmp\ijgqmzc.dll
Time & API Arguments Status Return Repeated

LookupPrivilegeValueW

 system_name:
privilege_name: SeDebugPrivilege
1 1 0
Time & API Arguments Status Return Repeated

NtAllocateVirtualMemory

 process_identifier: 2880
region_size: 167936
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x00400000
allocation_type: 12288 (MEM_COMMIT|MEM_RESERVE)
process_handle: 0x0000020c
1 0 0
Process injection Process 2768 called NtSetContextThread to modify thread in remote process 2880
Time & API Arguments Status Return Repeated

NtSetContextThread

 registers.eip: 2003108292
registers.esp: 1638384
registers.edi: 0
registers.eax: 4314160
registers.ebp: 0
registers.edx: 0
registers.ebx: 2130567168
registers.esi: 0
registers.ecx: 0
thread_handle: 0x00000208
process_identifier: 2880
1 0 0
Elastic malicious (high confidence)
MicroWorld-eScan Trojan.NSISX.Spy.Gen.2
FireEye Generic.mg.fd06b68ee03940e3
Cylance Unsafe
Cybereason malicious.ee0394
Cyren W32/Injector.AMK.gen!Eldorado
Symantec Packed.Generic.606
APEX Malicious
Kaspersky UDS:Trojan-Spy.Win32.Noon.gen
BitDefender Trojan.NSISX.Spy.Gen.2
Avast FileRepMetagen [Malware]
Sophos Mal/Generic-R
McAfee-GW-Edition BehavesLike.Win32.Generic.gc
Emsisoft Trojan.NSISX.Spy.Gen.2 (B)
Ikarus Trojan.NSIS.Agent
MAX malware (ai score=85)
Microsoft Trojan:Win32/Sabsik.FL.B!ml
GData Zum.Androm.1
Cynet Malicious (score: 100)
McAfee Artemis!FD06B68EE039
Malwarebytes Trojan.Injector
SentinelOne Static AI - Malicious PE
Fortinet W32/Injector.EOLV!tr
AVG FileRepMetagen [Malware]
Time & API Arguments Status Return Repeated

CreateProcessInternalW

 thread_identifier: 2884
thread_handle: 0x00000208
process_identifier: 2880
current_directory:
filepath: C:\Users\test22\AppData\Local\Temp\winlogon.exe
track: 1
command_line: "C:\Users\test22\AppData\Local\Temp\winlogon.exe"
filepath_r: C:\Users\test22\AppData\Local\Temp\winlogon.exe
stack_pivoted: 0
creation_flags: 134217732 (CREATE_NO_WINDOW|CREATE_SUSPENDED)
inherit_handles: 0
process_handle: 0x0000020c
1 1 0

NtGetContextThread

 thread_handle: 0x00000208
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2880
region_size: 167936
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x00400000
allocation_type: 12288 (MEM_COMMIT|MEM_RESERVE)
process_handle: 0x0000020c
1 0 0

NtSetContextThread

 registers.eip: 2003108292
registers.esp: 1638384
registers.edi: 0
registers.eax: 4314160
registers.ebp: 0
registers.edx: 0
registers.ebx: 2130567168
registers.esi: 0
registers.ecx: 0
thread_handle: 0x00000208
process_identifier: 2880
1 0 0