Summary | ZeroBOX

Category	Machine	Started	Completed
FILE	s1_win7_x6403_us	Nov. 17, 2021, 8 a.m.	Nov. 17, 2021, 8:04 a.m.

Size	1.2MB
Type	PE32 executable (GUI) Intel 80386, for MS Windows
MD5	`840a9628f0b877320c144b9968a036be`
SHA256	`1a14097ff774fe463491a6c444a4bf3f7419433ebfc86b511757f2f336e44b3b`
CRC32	`9A008367`
ssdeep	`24576:c2wLsk01gMeyzat4+5xeB8maz+/KcJ+Lb1bIH6nZ4bBR:AskT/yQ4+jemm4aJo1bIH6Ze`
PDB Path	wextract.pdb
Yara	Win32_Trojan_Emotet_RL_Gen_Zero - Win32 Trojan Emotet PE_Header_Zero - PE File Signature IsPE32 - (no description) Malicious_Library_Zero - Malicious_Library UPX_Zero - UPX packed file

333.exe "C:\Users\test22\AppData\Local\Temp\333.exe"
2316
- makecab.exe makecab
  2404
- cmd.exe cmd /c cmd < Scegliendo.pps
  2488
  - cmd.exe cmd
    2548
    - findstr.exe findstr /V /R "^HqqpGiftuqDiPimRPgWJVfnlGPtccJKuuAnCyDsUZiklFrajRramWifsCPDQeUJvfbqgJWLjWwKOrhFCbSEsslpZluqfZBS$" Confusione.pps
      2604
    - Puo.exe.com Puo.exe.com C
      2648
      - Puo.exe.com C:\Users\test22\AppData\Local\Temp\IXP000.TMP\Puo.exe.com C
        2716
        
        nslookup.exe C:\Windows\SysWOW64\nslookup.exe
        3044
    - PING.EXE ping 127.0.0.1
      2772

Name	Response	Post-Analysis Lookup
BgglqzlfstthqrDVch.BgglqzlfstthqrDVch

IP Address	Status	Action
164.124.101.2	Active	Moloch
178.23.190.57	Active	Moloch
185.163.47.176	Active	Moloch
193.38.54.238	Active	Moloch
74.119.192.122	Active	Moloch
91.219.236.162	Active	Moloch

Suricata Alerts

No Suricata Alerts

Suricata TLS

No Suricata TLS

Checks if process is being debugged by a debugger (3 events)

Time & API	Arguments	Status	Return	Repeated
IsDebuggerPresent Nov. 17, 2021, 8 a.m.			0	0
IsDebuggerPresent Nov. 17, 2021, 8 a.m.			0	0
IsDebuggerPresent Nov. 17, 2021, 8 a.m.			0	0

Command line console output was observed (50 out of 519 events)

Time & API	Arguments	Status	Return
WriteConsoleA Nov. 17, 2021, 8 a.m.	buffer: C console_handle: 0x00000007	1	1
WriteConsoleA Nov. 17, 2021, 8 a.m.	buffer: a console_handle: 0x00000007	1	1
WriteConsoleA Nov. 17, 2021, 8 a.m.	buffer: b console_handle: 0x00000007	1	1
WriteConsoleA Nov. 17, 2021, 8 a.m.	buffer: i console_handle: 0x00000007	1	1
WriteConsoleA Nov. 17, 2021, 8 a.m.	buffer: n console_handle: 0x00000007	1	1
WriteConsoleA Nov. 17, 2021, 8 a.m.	buffer: e console_handle: 0x00000007	1	1
WriteConsoleA Nov. 17, 2021, 8 a.m.	buffer: t console_handle: 0x00000007	1	1
WriteConsoleA Nov. 17, 2021, 8 a.m.	buffer: M console_handle: 0x00000007	1	1
WriteConsoleA Nov. 17, 2021, 8 a.m.	buffer: a console_handle: 0x00000007	1	1
WriteConsoleA Nov. 17, 2021, 8 a.m.	buffer: k console_handle: 0x00000007	1	1
WriteConsoleA Nov. 17, 2021, 8 a.m.	buffer: e console_handle: 0x00000007	1	1
WriteConsoleA Nov. 17, 2021, 8 a.m.	buffer: r console_handle: 0x00000007	1	1
WriteConsoleA Nov. 17, 2021, 8 a.m.	buffer: L console_handle: 0x00000007	1	1
WriteConsoleA Nov. 17, 2021, 8 a.m.	buffer: o console_handle: 0x00000007	1	1
WriteConsoleA Nov. 17, 2021, 8 a.m.	buffer: s console_handle: 0x00000007	1	1
WriteConsoleA Nov. 17, 2021, 8 a.m.	buffer: s console_handle: 0x00000007	1	1
WriteConsoleA Nov. 17, 2021, 8 a.m.	buffer: l console_handle: 0x00000007	1	1
WriteConsoleA Nov. 17, 2021, 8 a.m.	buffer: e console_handle: 0x00000007	1	1
WriteConsoleA Nov. 17, 2021, 8 a.m.	buffer: s console_handle: 0x00000007	1	1
WriteConsoleA Nov. 17, 2021, 8 a.m.	buffer: s console_handle: 0x00000007	1	1
WriteConsoleA Nov. 17, 2021, 8 a.m.	buffer: D console_handle: 0x00000007	1	1
WriteConsoleA Nov. 17, 2021, 8 a.m.	buffer: a console_handle: 0x00000007	1	1
WriteConsoleA Nov. 17, 2021, 8 a.m.	buffer: t console_handle: 0x00000007	1	1
WriteConsoleA Nov. 17, 2021, 8 a.m.	buffer: a console_handle: 0x00000007	1	1
WriteConsoleA Nov. 17, 2021, 8 a.m.	buffer: C console_handle: 0x00000007	1	1
WriteConsoleA Nov. 17, 2021, 8 a.m.	buffer: o console_handle: 0x00000007	1	1
WriteConsoleA Nov. 17, 2021, 8 a.m.	buffer: m console_handle: 0x00000007	1	1
WriteConsoleA Nov. 17, 2021, 8 a.m.	buffer: p console_handle: 0x00000007	1	1
WriteConsoleA Nov. 17, 2021, 8 a.m.	buffer: r console_handle: 0x00000007	1	1
WriteConsoleA Nov. 17, 2021, 8 a.m.	buffer: e console_handle: 0x00000007	1	1
WriteConsoleA Nov. 17, 2021, 8 a.m.	buffer: s console_handle: 0x00000007	1	1
WriteConsoleA Nov. 17, 2021, 8 a.m.	buffer: s console_handle: 0x00000007	1	1
WriteConsoleA Nov. 17, 2021, 8 a.m.	buffer: i console_handle: 0x00000007	1	1
WriteConsoleA Nov. 17, 2021, 8 a.m.	buffer: o console_handle: 0x00000007	1	1
WriteConsoleA Nov. 17, 2021, 8 a.m.	buffer: n console_handle: 0x00000007	1	1
WriteConsoleA Nov. 17, 2021, 8 a.m.	buffer: T console_handle: 0x00000007	1	1
WriteConsoleA Nov. 17, 2021, 8 a.m.	buffer: o console_handle: 0x00000007	1	1
WriteConsoleA Nov. 17, 2021, 8 a.m.	buffer: o console_handle: 0x00000007	1	1
WriteConsoleA Nov. 17, 2021, 8 a.m.	buffer: l console_handle: 0x00000007	1	1
WriteConsoleA Nov. 17, 2021, 8 a.m.	buffer: M console_handle: 0x00000007	1	1
WriteConsoleA Nov. 17, 2021, 8 a.m.	buffer: A console_handle: 0x00000007	1	1
WriteConsoleA Nov. 17, 2021, 8 a.m.	buffer: K console_handle: 0x00000007	1	1
WriteConsoleA Nov. 17, 2021, 8 a.m.	buffer: E console_handle: 0x00000007	1	1
WriteConsoleA Nov. 17, 2021, 8 a.m.	buffer: C console_handle: 0x00000007	1	1
WriteConsoleA Nov. 17, 2021, 8 a.m.	buffer: A console_handle: 0x00000007	1	1
WriteConsoleA Nov. 17, 2021, 8 a.m.	buffer: B console_handle: 0x00000007	1	1
WriteConsoleA Nov. 17, 2021, 8 a.m.	buffer: V console_handle: 0x00000007	1	1
WriteConsoleA Nov. 17, 2021, 8 a.m.	buffer: n console_handle: 0x00000007	1	1
WriteConsoleA Nov. 17, 2021, 8 a.m.	buffer: D console_handle: 0x00000007	1	1
WriteConsoleA Nov. 17, 2021, 8 a.m.	buffer: v console_handle: 0x00000007	1	1

This executable has a PDB path (1 event)

pdb_path

wextract.pdb

Checks amount of memory in system, this can be used to detect virtual machines that have a low amount of memory available (1 event)

Time & API	Arguments	Status	Return	Repeated
GlobalMemoryStatusEx Nov. 17, 2021, 8 a.m.		1	1	0

The file contains an unknown PE resource name possibly indicative of a packer (1 event)

resource name

AVI

One or more potentially interesting buffers were extracted, these generally contain injected code, configuration data, etc.

Queries the disk size which could be used to detect virtual machine with small fixed size or dynamic allocation (2 events)

Time & API	Arguments	Status	Return	Repeated
GetDiskFreeSpaceW Nov. 17, 2021, 8 a.m.	number_of_free_clusters: 2499034 sectors_per_cluster: 8 bytes_per_sector: 512 root_path: \ total_number_of_clusters: 8362495	1	1	0
GetDiskFreeSpaceW Nov. 17, 2021, 8 a.m.	number_of_free_clusters: 2499034 sectors_per_cluster: 8 bytes_per_sector: 512 root_path: \ total_number_of_clusters: 8362495	1	1	0

Creates executable files on the filesystem (1 event)

file	C:\Users\test22\AppData\Local\Temp\IXP000.TMP\Puo.exe.com

Drops a binary and executes it (1 event)

file	C:\Users\test22\AppData\Local\Temp\IXP000.TMP\Puo.exe.com

Drops an executable to the user AppData folder (1 event)

file	C:\Users\test22\AppData\Local\Temp\IXP000.TMP\Puo.exe.com

The binary likely contains encrypted or compressed data indicative of a packer (2 events)

section

{u'size_of_data': u'0x00131e00', u'virtual_address': u'0x0000d000', u'entropy': 7.987982289492244, u'name': u'.rsrc', u'virtual_size': u'0x00131d9f'}

entropy

7.98798228949

description

A section with a high entropy has been found

entropy

0.968725257324

description

Overall entropy of this PE file is high

Potentially malicious URLs were found in the process memory dump (3 events)

url	http://www.microsoft.com/schemas/ie8tldlistdescription/1.0
url	http://purl.org/rss/1.0/
url	http://www.passport.com

Yara rule detected in process memory (32 events)

description	Create a windows service	rule	Create_Service
description	Communication using DGA	rule	Network_DGA
description	Communications over RAW Socket	rule	Network_TCP_Socket
description	Steal credential	rule	local_credential_Steal
description	Communications use DNS	rule	Network_DNS
description	Match Windows Inet API call	rule	Str_Win32_Internet_API
description	Hijack network configuration	rule	Hijack_Network
description	Code injection with CreateRemoteThread in a remote process	rule	Code_injection
description	Record Audio	rule	Sniff_Audio
description	Communications over HTTP	rule	Network_HTTP
description	Run a KeyLogger	rule	KeyLogger
description	Communications over FTP	rule	Network_FTP
description	Escalate priviledges	rule	Escalate_priviledges
description	File Downloader	rule	Network_Downloader
description	Take ScreenShot	rule	ScreenShot
description	Match Windows Http API call	rule	Str_Win32_Http_API
description	Communications over P2P network	rule	Network_P2P_Win
description	(no description)	rule	DebuggerCheck__GlobalFlags
description	(no description)	rule	DebuggerCheck__QueryInfo
description	(no description)	rule	DebuggerCheck__RemoteAPI
description	(no description)	rule	DebuggerHiding__Thread
description	(no description)	rule	DebuggerHiding__Active
description	(no description)	rule	DebuggerException__ConsoleCtrl
description	(no description)	rule	DebuggerException__SetConsoleCtrl
description	(no description)	rule	ThreadControl__Context
description	(no description)	rule	SEH__vectored
description	(no description)	rule	Check_Dlls
description	Checks if being debugged	rule	anti_dbg
description	Anti-Sandbox checks for ThreatExpert	rule	antisb_threatExpert
description	Bypass DEP	rule	disable_dep
description	Affect hook table	rule	win_hook
description	Install itself for autorun at Windows startup	rule	Persistence

Uses Windows utilities for basic Windows functionality (2 events)

cmdline	C:\Windows\SysWOW64\nslookup.exe
cmdline	ping 127.0.0.1

One or more of the buffers contains an embedded PE file (2 events)

buffer	Buffer with sha1: 2e2b312983d54c05f1f26a6a1d2f5c0da5c526c1
buffer	Buffer with sha1: c52c96acfb1ea1468e2c65aae482be9286957263

Communicates with host for which no DNS query was performed (5 events)

host	178.23.190.57
host	185.163.47.176
host	193.38.54.238
host	74.119.192.122
host	91.219.236.162

Allocates execute permission to another process indicative of possible code injection (1 event)

Time & API	Arguments	Status	Return	Repeated
NtProtectVirtualMemory Nov. 17, 2021, 8:01 a.m.	process_identifier: 3044 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 593920 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000f0000 process_handle: 0x00000208	1	0	0

Installs itself for autorun at Windows startup (1 event)

reg_key

HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0

reg_value

rundll32.exe C:\Windows\system32\advpack.dll,DelNodeRunDLL32 "C:\Users\test22\AppData\Local\Temp\IXP000.TMP\"

Potential code injection by writing to the memory of another process (1 event)

Time & API	Arguments	Status	Return	Repeated
WriteProcessMemory Nov. 17, 2021, 8:01 a.m.	buffer: ÿÿÿÿû~(ü~Pý~mèÿÿ jHâý~± base_address: 0x7efde000 process_identifier: 3044 process_handle: 0x00000208	1	1	0

Used NtSetContextThread to modify a thread in a remote process indicative of process injection (2 events)

Time & API	Arguments	Status	Return	Repeated
Process injection	Process 2716 called NtSetContextThread to modify thread in remote process 3044
NtSetContextThread Nov. 17, 2021, 8:01 a.m.	registers.eip: 1999372740 registers.esp: 850208 registers.edi: 0 registers.eax: 1241462 registers.ebp: 0 registers.edx: 0 registers.ebx: 2130567168 registers.esi: 0 registers.ecx: 0 thread_handle: 0x00000170 process_identifier: 3044	1	0	0

Resumed a suspended thread in a remote process potentially indicative of process injection (2 events)

Time & API	Arguments	Status	Return	Repeated
Process injection	Process 2548 resumed a thread in remote process 2648
NtResumeThread Nov. 17, 2021, 8 a.m.	thread_handle: 0x0000008c suspend_count: 0 process_identifier: 2648	1	0	0

Executed a process and injected code into it, probably while unpacking (17 events)

Time & API	Arguments	Status	Return
NtResumeThread Nov. 17, 2021, 8 a.m.	thread_handle: 0x00000134 suspend_count: 1 process_identifier: 2316	1	0
CreateProcessInternalW Nov. 17, 2021, 8 a.m.	thread_identifier: 2408 thread_handle: 0x000000e4 process_identifier: 2404 current_directory: filepath: track: 1 command_line: makecab filepath_r: stack_pivoted: 0 creation_flags: 32 (NORMAL_PRIORITY_CLASS) inherit_handles: 0 process_handle: 0x00000140	1	1
CreateProcessInternalW Nov. 17, 2021, 8 a.m.	thread_identifier: 2492 thread_handle: 0x00000140 process_identifier: 2488 current_directory: filepath: track: 1 command_line: cmd /c cmd < Scegliendo.pps filepath_r: stack_pivoted: 0 creation_flags: 32 (NORMAL_PRIORITY_CLASS) inherit_handles: 0 process_handle: 0x000000e4	1	1
CreateProcessInternalW Nov. 17, 2021, 8 a.m.	thread_identifier: 2552 thread_handle: 0x00000088 process_identifier: 2548 current_directory: C:\Users\test22\AppData\Local\Temp\IXP000.TMP filepath: C:\Windows\System32\cmd.exe track: 1 command_line: cmd filepath_r: C:\Windows\system32\cmd.exe stack_pivoted: 0 creation_flags: 524288 (EXTENDED_STARTUPINFO_PRESENT) inherit_handles: 1 process_handle: 0x0000008c	1	1
CreateProcessInternalW Nov. 17, 2021, 8 a.m.	thread_identifier: 2608 thread_handle: 0x00000088 process_identifier: 2604 current_directory: C:\Users\test22\AppData\Local\Temp\IXP000.TMP filepath: C:\Windows\System32\findstr.exe track: 1 command_line: findstr /V /R "^HqqpGiftuqDiPimRPgWJVfnlGPtccJKuuAnCyDsUZiklFrajRramWifsCPDQeUJvfbqgJWLjWwKOrhFCbSEsslpZluqfZBS$" Confusione.pps filepath_r: C:\Windows\system32\findstr.exe stack_pivoted: 0 creation_flags: 524288 (EXTENDED_STARTUPINFO_PRESENT) inherit_handles: 1 process_handle: 0x00000090	1	1
CreateProcessInternalW Nov. 17, 2021, 8 a.m.	thread_identifier: 2652 thread_handle: 0x0000008c process_identifier: 2648 current_directory: filepath: C:\Users\test22\AppData\Local\Temp\IXP000.TMP\Puo.exe.com track: 1 command_line: Puo.exe.com C filepath_r: C:\Users\test22\AppData\Local\Temp\IXP000.TMP\Puo.exe.com stack_pivoted: 0 creation_flags: 525328 (CREATE_NEW_CONSOLE\|CREATE_UNICODE_ENVIRONMENT\|EXTENDED_STARTUPINFO_PRESENT) inherit_handles: 1 process_handle: 0x00000090	1	1
NtResumeThread Nov. 17, 2021, 8 a.m.	thread_handle: 0x0000008c suspend_count: 0 process_identifier: 2648	1	0
CreateProcessInternalW Nov. 17, 2021, 8 a.m.	thread_identifier: 2776 thread_handle: 0x00000090 process_identifier: 2772 current_directory: C:\Users\test22\AppData\Local\Temp\IXP000.TMP filepath: C:\Windows\System32\PING.EXE track: 1 command_line: ping 127.0.0.1 filepath_r: C:\Windows\system32\PING.EXE stack_pivoted: 0 creation_flags: 524288 (EXTENDED_STARTUPINFO_PRESENT) inherit_handles: 1 process_handle: 0x0000008c	1	1
CreateProcessInternalW Nov. 17, 2021, 8 a.m.	thread_identifier: 2720 thread_handle: 0x00000134 process_identifier: 2716 current_directory: C:\Users\test22\AppData\Local\Temp\IXP000.TMP filepath: track: 1 command_line: C:\Users\test22\AppData\Local\Temp\IXP000.TMP\Puo.exe.com C filepath_r: stack_pivoted: 0 creation_flags: 0 () inherit_handles: 0 process_handle: 0x00000138	1	1
CreateProcessInternalW Nov. 17, 2021, 8:01 a.m.	thread_identifier: 3048 thread_handle: 0x00000170 process_identifier: 3044 current_directory: filepath: track: 1 command_line: C:\Windows\SysWOW64\nslookup.exe filepath_r: stack_pivoted: 0 creation_flags: 134217732 (CREATE_NO_WINDOW\|CREATE_SUSPENDED) inherit_handles: 0 process_handle: 0x00000208	1	1
NtGetContextThread Nov. 17, 2021, 8:01 a.m.	thread_handle: 0x00000170	1	0
NtAllocateVirtualMemory Nov. 17, 2021, 8:01 a.m.	process_identifier: 3044 region_size: 593920 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 4 (PAGE_READWRITE) base_address: 0x000f0000 allocation_type: 12289 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0x00000208	1	0
WriteProcessMemory Nov. 17, 2021, 8:01 a.m.	buffer: base_address: 0x000f0000 process_identifier: 3044 process_handle: 0x00000208	1	1
WriteProcessMemory Nov. 17, 2021, 8:01 a.m.	buffer: ÿÿÿÿû~(ü~Pý~mèÿÿ jHâý~± base_address: 0x7efde000 process_identifier: 3044 process_handle: 0x00000208	1	1
NtSetContextThread Nov. 17, 2021, 8:01 a.m.	registers.eip: 1999372740 registers.esp: 850208 registers.edi: 0 registers.eax: 1241462 registers.ebp: 0 registers.edx: 0 registers.ebx: 2130567168 registers.esi: 0 registers.ecx: 0 thread_handle: 0x00000170 process_identifier: 3044	1	0
NtResumeThread Nov. 17, 2021, 8 a.m.	thread_handle: 0x000000dc suspend_count: 1 process_identifier: 2772	1	0
NtResumeThread Nov. 17, 2021, 8:01 a.m.	thread_handle: 0x00000144 suspend_count: 1 process_identifier: 3044	1	0

File has been identified by 37 AntiVirus engines on VirusTotal as malicious (37 events)

Lionic	Trojan.Win32.Agent.m!c
Elastic	malicious (high confidence)
McAfee	Artemis!840A9628F0B8
Cylance	Unsafe
K7AntiVirus	Trojan ( 0058a6f81 )
Alibaba	Packed:Win32/AVEvader.5c134b8d
K7GW	Trojan ( 0058a6f81 )
Symantec	ML.Attribute.HighConfidence
ESET-NOD32	a variant of Win32/Packed.CAB.BB suspicious
APEX	Malicious
Kaspersky	Backdoor.Win32.Agent.myufbk
BitDefender	Trojan.GenericKD.38030323
MicroWorld-eScan	Trojan.GenericKD.38030323
Avast	Win32:Malware-gen
Ad-Aware	Trojan.GenericKD.38030323
Emsisoft	Trojan.GenericKD.38030323 (B)
TrendMicro	TROJ_FRS.0NA104KG21
McAfee-GW-Edition	BehavesLike.Win32.Dropper.tc
FireEye	Generic.mg.840a9628f0b87732
Sophos	Mal/Generic-S
SentinelOne	Static AI - Suspicious PE
GData	Trojan.GenericKD.38030323
Webroot	W32.Trojan.Gen
MAX	malware (ai score=89)
Kingsoft	Win32.Hack.Agent.(kcloud)
Gridinsoft	Ransom.Win32.Sabsik.sa
Arcabit	Trojan.Generic.D2444BF3
ViRobot	Trojan.Win32.Z.Highconfidence.1294336
Microsoft	Trojan:Win32/Sabsik.FL.B!ml
AhnLab-V3	Trojan/Win.Generic.C4773206
Malwarebytes	Backdoor.Agent
TrendMicro-HouseCall	TROJ_FRS.0NA104KG21
Tencent	Win32.Backdoor.Agent.Dxcs
eGambit	Unsafe.AI_Score_99%
Fortinet	W32/Malicious_Behavior.VEX
AVG	Win32:Malware-gen
Panda	Trj/CI.A

Connects to IP addresses that are no longer responding to requests (legitimate services will remain up-and-running usually) (15 events)

dead_host	192.168.56.103:49188
dead_host	192.168.56.103:49191
dead_host	192.168.56.103:49190
dead_host	178.23.190.57:80
dead_host	74.119.192.122:80
dead_host	192.168.56.103:49187
dead_host	192.168.56.103:49177
dead_host	192.168.56.103:49175
dead_host	192.168.56.103:49176
dead_host	192.168.56.103:49180
dead_host	192.168.56.103:49179
dead_host	185.163.47.176:80
dead_host	192.168.56.103:49178
dead_host	192.168.56.103:49189
dead_host	91.219.236.162:80

333.exe

Process Tree Toggle all

Network Toggle all

Suricata Toggle all

Suricata Alerts

Suricata TLS

Signatures Toggle All