Summary | ZeroBOX

Category	Machine	Started	Completed
FILE	s1_win7_x6401	Nov. 3, 2021, 9:25 a.m.	Nov. 3, 2021, 9:38 a.m.

Size	284.1KB
Type	PE32 executable (GUI) Intel 80386, for MS Windows, Nullsoft Installer self-extracting archive
MD5	`0362c14d2b1389973027a71faa08d013`
SHA256	`5e39768c8fd6bb7644322000828b9bd1c34d25c3be1a9a712761ba834910fcf0`
CRC32	`39A658D6`
ssdeep	`6144:wBlL/c36rQHyHr43WNdO1QE1DDWLW9+MexU3q16FYyms4FjK/BM:Ce3JjmNdOfWiEM13q1kYhFUBM`
Yara	PE_Header_Zero - PE File Signature IsPE32 - (no description) Malicious_Library_Zero - Malicious_Library UPX_Zero - UPX packed file NSIS_Installer - Null Soft Installer

rundll32.exe "C:\Users\test22\AppData\Local\Temp\rundll32.exe"
2772
- rundll32.exe "C:\Users\test22\AppData\Local\Temp\rundll32.exe"
  2884

Name	Response	Post-Analysis Lookup
www.waltersswholesale.com	A 166.88.19.180 A 68.68.98.160 A 166.88.19.181	166.88.19.181
www.picturebookoriginals.com
www.cletechsolutions.com	A 192.0.78.25 A 192.0.78.24 CNAME cletechsolutions.com	192.0.78.24
www.shopvintageallure.com	CNAME shopvintageallure.com A 34.102.136.180	34.102.136.180
www.chahuima.com	A 155.235.2.174	155.235.2.174
www.boraviajar.website	A 104.21.53.194 A 172.67.217.247	172.67.217.247
www.fly-crypto.com
www.workerscompfl1.com	A 162.209.67.117	162.209.67.117
www.servicesitcy.com	A 63.250.43.16 CNAME servicesitcy.com A 63.250.43.15	63.250.43.15
www.skin4trade.com	A 2.57.90.16 CNAME skin4trade.com	2.57.90.16
www.dairatwsl.com	CNAME dairatwsl.com A 62.77.153.150	62.77.153.150
www.drmichaelirvine.com	A 44.231.165.140 A 54.71.30.209 CNAME website.simplepractice.com CNAME nlb-public-b49550eab92de245.elb.us-west-2.amazonaws.com	54.71.30.209
www.kymyra.com	A 34.102.136.180 CNAME kymyra.com	34.102.136.180
www.certidaoja.com	A 34.102.136.180 CNAME certidaoja.com	34.102.136.180

IP Address	Status	Action
155.235.2.174	Active	Moloch
162.209.67.117	Active	Moloch
164.124.101.2	Active	Moloch
166.88.19.181	Active	Moloch
172.67.217.247	Active	Moloch
192.0.78.24	Active	Moloch
2.57.90.16	Active	Moloch
34.102.136.180	Active	Moloch
44.231.165.140	Active	Moloch
62.77.153.150	Active	Moloch
63.250.43.16	Active	Moloch

Suricata Alerts

No Suricata Alerts

Suricata TLS

No Suricata TLS

Checks amount of memory in system, this can be used to detect virtual machines that have a low amount of memory available (1 event)

Time & API	Arguments	Status	Return	Repeated
GlobalMemoryStatusEx Nov. 3, 2021, 9:25 a.m.		1	1	0

The executable contains unknown PE section names indicative of a packer (could be a false positive) (1 event)

section

.ndata

HTTP traffic contains suspicious features which may be indicative of malware related traffic (10 events)

suspicious_features	GET method with no useragent header	suspicious_request	GET http://www.workerscompfl1.com/yrcy/?Q2J=v7uhzqxdVE4SqOwlUNUHJhsYFShuFcyud5s4FQa9exy1ydsUebHf3DsshfGZM9gXbmjgSaig&3f_XA=hpZXWrzxUPfpU460
suspicious_features	GET method with no useragent header	suspicious_request	GET http://www.cletechsolutions.com/yrcy/?Q2J=6oj+cRAbTTzt/2NBJRHF0KzLhmFT0afQnvz1X6yVwGfVu9zh+SVYbLRsBqi/up4gZGLNczfN&3f_XA=hpZXWrzxUPfpU460
suspicious_features	GET method with no useragent header	suspicious_request	GET http://www.servicesitcy.com/yrcy/?Q2J=OzT5Kgogcfa2m/rN5I4GXN43s0X5NcPImpThPzCAgeve7satzTJ0I6SdUWkzkMw2WgeaZXMj&3f_XA=hpZXWrzxUPfpU460
suspicious_features	GET method with no useragent header	suspicious_request	GET http://www.dairatwsl.com/yrcy/?Q2J=e/RF5WkoBurfC9A70hYVOLL0JiY85m+wPQ7mJBVhAbkMJKQBASQfBfdR/akm2hHY700q4f3X&3f_XA=hpZXWrzxUPfpU460
suspicious_features	GET method with no useragent header	suspicious_request	GET http://www.shopvintageallure.com/yrcy/?Q2J=iR6icyAG5qbROQOE+puwuf7Eqk2frf0JSC5eXEZSJFvjgjfWFMvRs5gE1q0GoheX8zH1DpAA&3f_XA=hpZXWrzxUPfpU460
suspicious_features	GET method with no useragent header	suspicious_request	GET http://www.certidaoja.com/yrcy/?Q2J=2STKbn6S1T/DsyanOK2Ha9M0t4IXH/juVnAoegb5vtHBf3PYbBf4xwu2U3ZJH68ioeHd6W0D&3f_XA=hpZXWrzxUPfpU460
suspicious_features	GET method with no useragent header	suspicious_request	GET http://www.drmichaelirvine.com/yrcy/?Q2J=aw6RPX4C+h2jRvxSKzrdN77eUH6zVw/uBwCUGBgH66uHu3DhjC1vmmh9WqU0RPTTS1I3MpdI&3f_XA=hpZXWrzxUPfpU460
suspicious_features	GET method with no useragent header	suspicious_request	GET http://www.kymyra.com/yrcy/?Q2J=3ogv6bzFHfLn7VYVVblVN0m+XFAqVDWG91g7sP77Zgb7+jX2xbPsIoUSZc/+sASQWUYNjkTA&3f_XA=hpZXWrzxUPfpU460
suspicious_features	GET method with no useragent header	suspicious_request	GET http://www.skin4trade.com/yrcy/?Q2J=2ebRQTI/pNMxqCBe0h7MquAAnLVJt3LXhIxkkHZMBDwVd63pdWgA/U+BAqtzfUdwYvXWANqM&3f_XA=hpZXWrzxUPfpU460
suspicious_features	GET method with no useragent header	suspicious_request	GET http://www.boraviajar.website/yrcy/?Q2J=xgKSkpShHNAI7tN4C4ihJGvxSZi5QC5kqEH1E7OrqywLRYaYWb/614Rhw66pXiS1YHUKYEcm&3f_XA=hpZXWrzxUPfpU460

Performs some HTTP requests (10 events)

request	GET http://www.workerscompfl1.com/yrcy/?Q2J=v7uhzqxdVE4SqOwlUNUHJhsYFShuFcyud5s4FQa9exy1ydsUebHf3DsshfGZM9gXbmjgSaig&3f_XA=hpZXWrzxUPfpU460
request	GET http://www.cletechsolutions.com/yrcy/?Q2J=6oj+cRAbTTzt/2NBJRHF0KzLhmFT0afQnvz1X6yVwGfVu9zh+SVYbLRsBqi/up4gZGLNczfN&3f_XA=hpZXWrzxUPfpU460
request	GET http://www.servicesitcy.com/yrcy/?Q2J=OzT5Kgogcfa2m/rN5I4GXN43s0X5NcPImpThPzCAgeve7satzTJ0I6SdUWkzkMw2WgeaZXMj&3f_XA=hpZXWrzxUPfpU460
request	GET http://www.dairatwsl.com/yrcy/?Q2J=e/RF5WkoBurfC9A70hYVOLL0JiY85m+wPQ7mJBVhAbkMJKQBASQfBfdR/akm2hHY700q4f3X&3f_XA=hpZXWrzxUPfpU460
request	GET http://www.shopvintageallure.com/yrcy/?Q2J=iR6icyAG5qbROQOE+puwuf7Eqk2frf0JSC5eXEZSJFvjgjfWFMvRs5gE1q0GoheX8zH1DpAA&3f_XA=hpZXWrzxUPfpU460
request	GET http://www.certidaoja.com/yrcy/?Q2J=2STKbn6S1T/DsyanOK2Ha9M0t4IXH/juVnAoegb5vtHBf3PYbBf4xwu2U3ZJH68ioeHd6W0D&3f_XA=hpZXWrzxUPfpU460
request	GET http://www.drmichaelirvine.com/yrcy/?Q2J=aw6RPX4C+h2jRvxSKzrdN77eUH6zVw/uBwCUGBgH66uHu3DhjC1vmmh9WqU0RPTTS1I3MpdI&3f_XA=hpZXWrzxUPfpU460
request	GET http://www.kymyra.com/yrcy/?Q2J=3ogv6bzFHfLn7VYVVblVN0m+XFAqVDWG91g7sP77Zgb7+jX2xbPsIoUSZc/+sASQWUYNjkTA&3f_XA=hpZXWrzxUPfpU460
request	GET http://www.skin4trade.com/yrcy/?Q2J=2ebRQTI/pNMxqCBe0h7MquAAnLVJt3LXhIxkkHZMBDwVd63pdWgA/U+BAqtzfUdwYvXWANqM&3f_XA=hpZXWrzxUPfpU460
request	GET http://www.boraviajar.website/yrcy/?Q2J=xgKSkpShHNAI7tN4C4ihJGvxSZi5QC5kqEH1E7OrqywLRYaYWb/614Rhw66pXiS1YHUKYEcm&3f_XA=hpZXWrzxUPfpU460

Allocates read-write-execute memory (usually to unpack itself) (26 events)

Time & API	Arguments	Status
NtProtectVirtualMemory Nov. 3, 2021, 9:25 a.m.	process_identifier: 2772 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x73d90000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Nov. 3, 2021, 9:25 a.m.	process_identifier: 2772 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x74e71000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Nov. 3, 2021, 9:25 a.m.	process_identifier: 2772 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x76111000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Nov. 3, 2021, 9:25 a.m.	process_identifier: 2772 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x76001000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Nov. 3, 2021, 9:25 a.m.	process_identifier: 2772 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x73c81000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Nov. 3, 2021, 9:25 a.m.	process_identifier: 2772 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x746d1000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Nov. 3, 2021, 9:25 a.m.	process_identifier: 2772 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x73c41000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Nov. 3, 2021, 9:25 a.m.	process_identifier: 2772 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x763a1000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Nov. 3, 2021, 9:25 a.m.	process_identifier: 2772 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x73aa1000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Nov. 3, 2021, 9:25 a.m.	process_identifier: 2772 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x73a71000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Nov. 3, 2021, 9:25 a.m.	process_identifier: 2772 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x76a81000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Nov. 3, 2021, 9:25 a.m.	process_identifier: 2772 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x73991000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Nov. 3, 2021, 9:25 a.m.	process_identifier: 2772 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x73461000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Nov. 3, 2021, 9:25 a.m.	process_identifier: 2772 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x73424000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Nov. 3, 2021, 9:25 a.m.	process_identifier: 2772 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x73462000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Nov. 3, 2021, 9:25 a.m.	process_identifier: 2772 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x10019000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Nov. 3, 2021, 9:25 a.m.	process_identifier: 2772 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x75291000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Nov. 3, 2021, 9:25 a.m.	process_identifier: 2772 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x750c1000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Nov. 3, 2021, 9:25 a.m.	process_identifier: 2772 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x76451000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Nov. 3, 2021, 9:25 a.m.	process_identifier: 2772 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x73381000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Nov. 3, 2021, 9:25 a.m.	process_identifier: 2772 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x742e1000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Nov. 3, 2021, 9:25 a.m.	process_identifier: 2772 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x761a1000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Nov. 3, 2021, 9:25 a.m.	process_identifier: 2772 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x73a41000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Nov. 3, 2021, 9:25 a.m.	process_identifier: 2772 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x73361000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Nov. 3, 2021, 9:25 a.m.	process_identifier: 2772 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 8192 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x1001b000 process_handle: 0xffffffff	1
NtAllocateVirtualMemory Nov. 3, 2021, 9:25 a.m.	process_identifier: 2884 region_size: 3158016 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x02220000 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0xffffffff	1

Creates executable files on the filesystem (1 event)

file	C:\Users\test22\AppData\Local\Temp\nseE233.tmp\ibgiyuxot.dll

Drops an executable to the user AppData folder (1 event)

file	C:\Users\test22\AppData\Local\Temp\nseE233.tmp\ibgiyuxot.dll

Checks for the Locally Unique Identifier on the system for a suspicious privilege (1 event)

Time & API	Arguments	Status	Return	Repeated
LookupPrivilegeValueW Nov. 3, 2021, 9:25 a.m.	system_name: privilege_name: SeDebugPrivilege	1	1	0

Allocates execute permission to another process indicative of possible code injection (1 event)

Time & API	Arguments	Status	Return	Repeated
NtAllocateVirtualMemory Nov. 3, 2021, 9:25 a.m.	process_identifier: 2884 region_size: 167936 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00400000 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0x00000238	1	0	0

Used NtSetContextThread to modify a thread in a remote process indicative of process injection (2 events)

Time & API	Arguments	Status	Return	Repeated
Process injection	Process 2772 called NtSetContextThread to modify thread in remote process 2884
NtSetContextThread Nov. 3, 2021, 9:25 a.m.	registers.eip: 2003108292 registers.esp: 1638384 registers.edi: 0 registers.eax: 4314288 registers.ebp: 0 registers.edx: 0 registers.ebx: 2130567168 registers.esi: 0 registers.ecx: 0 thread_handle: 0x00000218 process_identifier: 2884	1	0	0

File has been identified by 26 AntiVirus engines on VirusTotal as malicious (26 events)

Lionic	Trojan.Win32.Zapchast.4!c
Elastic	malicious (high confidence)
MicroWorld-eScan	Trojan.NSISX.Spy.Gen.2
FireEye	Generic.mg.0362c14d2b138997
Sangfor	Trojan.Win32.Save.a
Cybereason	malicious.d2b138
Cyren	W32/Injector.AOJ.gen!Eldorado
ESET-NOD32	a variant of Win32/Injector.EQKZ
APEX	Malicious
Paloalto	generic.ml
Kaspersky	UDS:DangerousObject.Multi.Generic
BitDefender	Trojan.GenericKD.47312389
Avast	Win32:RATX-gen [Trj]
Tencent	Win32.Trojan.Zapchast.Dks
Emsisoft	Trojan.NSISX.Spy.Gen.2 (B)
McAfee-GW-Edition	BehavesLike.Win32.Puper.dc
Sophos	Mal/Generic-S
Ikarus	Trojan.NSIS.Agent
Webroot	W32.Trojan.Gen
GData	Win32.Trojan-Stealer.FormBook.MWIBS5
Cynet	Malicious (score: 100)
McAfee	RDN/Generic.dx
MAX	malware (ai score=83)
SentinelOne	Static AI - Malicious PE
Fortinet	W32/Injector.EQKA!tr
AVG	Win32:RATX-gen [Trj]

Connects to an IP address that is no longer responding to requests (legitimate services will remain up-and-running usually) (1 event)

dead_host

155.235.2.174:80

Executed a process and injected code into it, probably while unpacking (4 events)

Time & API	Arguments	Status	Return
CreateProcessInternalW Nov. 3, 2021, 9:25 a.m.	thread_identifier: 2888 thread_handle: 0x00000218 process_identifier: 2884 current_directory: filepath: C:\Users\test22\AppData\Local\Temp\rundll32.exe track: 1 command_line: "C:\Users\test22\AppData\Local\Temp\rundll32.exe" filepath_r: C:\Users\test22\AppData\Local\Temp\rundll32.exe stack_pivoted: 0 creation_flags: 134217732 (CREATE_NO_WINDOW\|CREATE_SUSPENDED) inherit_handles: 0 process_handle: 0x00000238	1	1
NtGetContextThread Nov. 3, 2021, 9:25 a.m.	thread_handle: 0x00000218	1	0
NtAllocateVirtualMemory Nov. 3, 2021, 9:25 a.m.	process_identifier: 2884 region_size: 167936 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00400000 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0x00000238	1	0
NtSetContextThread Nov. 3, 2021, 9:25 a.m.	registers.eip: 2003108292 registers.esp: 1638384 registers.edi: 0 registers.eax: 4314288 registers.ebp: 0 registers.edx: 0 registers.ebx: 2130567168 registers.esi: 0 registers.ecx: 0 thread_handle: 0x00000218 process_identifier: 2884	1	0

rundll32.exe

Process Tree Toggle all

Network Toggle all

Suricata Toggle all

Suricata Alerts

Suricata TLS

Signatures Toggle All