popup
Summary | ZeroBOX
  1. Home
  2. Result
  3. Report
  4. Detail Analysis

toolspab2.exe

Darkside Ransomware Cobalt Strike Malicious Library UPX AntiDebug OS Processor Check PE32 PE File AntiVM
  1. Resubmit sample
    Category Machine Started Completed
    FILE s1_win7_x6403_us Feb. 25, 2022, 5:34 p.m. Feb. 25, 2022, 5:48 p.m.
    Size 331.0KB
    Type PE32 executable (GUI) Intel 80386, for MS Windows
    MD5 f2336cbcb716869cea7e6d49f5749f1b
    SHA256 18b55dc084fe9cf7b3e1703f2da6fef120543f15d81805a282b788f7cd4f2282
    CRC32 28D395AA
    ssdeep 6144:8667auJWDDhFWZuNAyiDuEPj7N/6FsiMaJde:hiWDDhFreyiDLPjh/6Fq
    PDB Path C:\yuyun-zigixutotir\jajoxagoliwod-wejagez-vofiv.pdb
    Yara
    • PE_Header_Zero - PE File Signature
    • OS_Processor_Check_Zero - OS Processor Check
    • IsPE32 - (no description)
    • Malicious_Library_Zero - Malicious_Library
    • Trojan_DarkSide_Ransomware_1_Zero - Darkside Ransomware
    • UPX_Zero - UPX packed file

    Name Response Post-Analysis Lookup
    No hosts contacted.
    IP Address Status Action
    No hosts contacted.

    Suricata Alerts

    No Suricata Alerts

    Suricata TLS

    No Suricata TLS

    Time & API Arguments Status Return Repeated

    IsDebuggerPresent

    		 0 0
    pdb_path C:\yuyun-zigixutotir\jajoxagoliwod-wejagez-vofiv.pdb
    Time & API Arguments Status Return Repeated

    NtProtectVirtualMemory

    		 process_identifier: 2276
    stack_dep_bypass: 0
    stack_pivoted: 0
    heap_dep_bypass: 1
    length: 65536
    protection: 64 (PAGE_EXECUTE_READWRITE)
    base_address: 0x02c1c000
    process_handle: 0xffffffff
    		1 0 0

    NtAllocateVirtualMemory

    		 process_identifier: 2276
    region_size: 36864
    stack_dep_bypass: 0
    stack_pivoted: 0
    heap_dep_bypass: 0
    protection: 64 (PAGE_EXECUTE_READWRITE)
    base_address: 0x003a0000
    allocation_type: 4096 (MEM_COMMIT)
    process_handle: 0xffffffff
    		1 0 0
    name RT_CURSOR language LANG_SERBIAN filetype dBase III DBT, version number 0, next free block index 40, 1st item "\251\317" sublanguage *unknown* offset 0x02706b20 size 0x000008a8
    name RT_CURSOR language LANG_SERBIAN filetype dBase III DBT, version number 0, next free block index 40, 1st item "\251\317" sublanguage *unknown* offset 0x02706b20 size 0x000008a8
    name RT_CURSOR language LANG_SERBIAN filetype dBase III DBT, version number 0, next free block index 40, 1st item "\251\317" sublanguage *unknown* offset 0x02706b20 size 0x000008a8
    name RT_CURSOR language LANG_SERBIAN filetype dBase III DBT, version number 0, next free block index 40, 1st item "\251\317" sublanguage *unknown* offset 0x02706b20 size 0x000008a8
    name RT_CURSOR language LANG_SERBIAN filetype dBase III DBT, version number 0, next free block index 40, 1st item "\251\317" sublanguage *unknown* offset 0x02706b20 size 0x000008a8
    name RT_ICON language LANG_SERBIAN filetype data sublanguage *unknown* offset 0x027045d0 size 0x000010a8
    name RT_ICON language LANG_SERBIAN filetype data sublanguage *unknown* offset 0x027045d0 size 0x000010a8
    name RT_ICON language LANG_SERBIAN filetype data sublanguage *unknown* offset 0x027045d0 size 0x000010a8
    name RT_ICON language LANG_SERBIAN filetype data sublanguage *unknown* offset 0x027045d0 size 0x000010a8
    name RT_ICON language LANG_SERBIAN filetype data sublanguage *unknown* offset 0x027045d0 size 0x000010a8
    name RT_ICON language LANG_SERBIAN filetype data sublanguage *unknown* offset 0x027045d0 size 0x000010a8
    name RT_ICON language LANG_SERBIAN filetype data sublanguage *unknown* offset 0x027045d0 size 0x000010a8
    name RT_STRING language LANG_SERBIAN filetype data sublanguage *unknown* offset 0x02707a28 size 0x00000128
    name RT_STRING language LANG_SERBIAN filetype data sublanguage *unknown* offset 0x02707a28 size 0x00000128
    name RT_STRING language LANG_SERBIAN filetype data sublanguage *unknown* offset 0x02707a28 size 0x00000128
    name RT_ACCELERATOR language LANG_SERBIAN filetype data sublanguage *unknown* offset 0x027056a0 size 0x00000020
    name RT_ACCELERATOR language LANG_SERBIAN filetype data sublanguage *unknown* offset 0x027056a0 size 0x00000020
    name RT_GROUP_CURSOR language LANG_SERBIAN filetype data sublanguage *unknown* offset 0x027073c8 size 0x00000014
    name RT_GROUP_CURSOR language LANG_SERBIAN filetype data sublanguage *unknown* offset 0x027073c8 size 0x00000014
    name RT_GROUP_CURSOR language LANG_SERBIAN filetype data sublanguage *unknown* offset 0x027073c8 size 0x00000014
    name RT_GROUP_ICON language LANG_SERBIAN filetype data sublanguage *unknown* offset 0x02705678 size 0x00000022
    name RT_GROUP_ICON language LANG_SERBIAN filetype data sublanguage *unknown* offset 0x02705678 size 0x00000022
    name RT_VERSION language LANG_SERBIAN filetype data sublanguage *unknown* offset 0x027073e0 size 0x00000130
    section {u'size_of_data': u'0x00010e00', u'virtual_address': u'0x00026000', u'entropy': 7.797876359945405, u'name': u'.data', u'virtual_size': u'0x026d8900'} entropy 7.79787635995 description A section with a high entropy has been found
    entropy 0.204545454545 description Overall entropy of this PE file is high
    description (no description) rule DebuggerCheck__GlobalFlags
    description (no description) rule DebuggerCheck__QueryInfo
    description (no description) rule DebuggerHiding__Thread
    description (no description) rule DebuggerHiding__Active
    description (no description) rule ThreadControl__Context
    description (no description) rule SEH__vectored
    description Bypass DEP rule disable_dep
    Time & API Arguments Status Return Repeated

    NtAllocateVirtualMemory

    		 process_identifier: 2364
    region_size: 36864
    stack_dep_bypass: 0
    stack_pivoted: 0
    heap_dep_bypass: 0
    protection: 64 (PAGE_EXECUTE_READWRITE)
    base_address: 0x00400000
    allocation_type: 12288 (MEM_COMMIT|MEM_RESERVE)
    process_handle: 0x00000080
    		1 0 0
    Time & API Arguments Status Return Repeated

    LdrGetDllHandle

    		 module_name: snxhk
    module_address: 0x00000000
    stack_pivoted: 0
    		3221225781 0

    LdrGetDllHandle

    		 module_name: snxhk
    module_address: 0x00000000
    stack_pivoted: 0
    		3221225781 0
    Time & API Arguments Status Return Repeated

    WriteProcessMemory

    		 buffer: @
    base_address: 0x7efde008
    process_identifier: 2364
    process_handle: 0x00000080
    		1 1 0
    Process injection Process 2276 called NtSetContextThread to modify thread in remote process 2364
    Time & API Arguments Status Return Repeated

    NtSetContextThread

    		 registers.eip: 1999372740
    registers.esp: 1638384
    registers.edi: 0
    registers.eax: 4206407
    registers.ebp: 0
    registers.edx: 0
    registers.ebx: 2130567168
    registers.esi: 0
    registers.ecx: 0
    thread_handle: 0x0000007c
    process_identifier: 2364
    		1 0 0
    Process injection Process 2276 resumed a thread in remote process 2364
    Time & API Arguments Status Return Repeated

    NtResumeThread

    		 thread_handle: 0x0000007c
    suspend_count: 1
    process_identifier: 2364
    		1 0 0
    Time & API Arguments Status Return Repeated

    CreateProcessInternalW

    		 thread_identifier: 2368
    thread_handle: 0x0000007c
    process_identifier: 2364
    current_directory:
    filepath: C:\Users\test22\AppData\Local\Temp\toolspab2.exe
    track: 1
    command_line: "C:\Users\test22\AppData\Local\Temp\toolspab2.exe"
    filepath_r: C:\Users\test22\AppData\Local\Temp\toolspab2.exe
    stack_pivoted: 0
    creation_flags: 134217732 (CREATE_NO_WINDOW|CREATE_SUSPENDED)
    inherit_handles: 0
    process_handle: 0x00000080
    		1 1 0

    NtGetContextThread

    		 thread_handle: 0x0000007c
    		1 0 0

    NtUnmapViewOfSection

    		 base_address: 0x00400000
    region_size: 4096
    process_identifier: 2364
    process_handle: 0x00000080
    		1 0 0

    NtAllocateVirtualMemory

    		 process_identifier: 2364
    region_size: 36864
    stack_dep_bypass: 0
    stack_pivoted: 0
    heap_dep_bypass: 0
    protection: 64 (PAGE_EXECUTE_READWRITE)
    base_address: 0x00400000
    allocation_type: 12288 (MEM_COMMIT|MEM_RESERVE)
    process_handle: 0x00000080
    		1 0 0

    WriteProcessMemory

    		 buffer: @
    base_address: 0x7efde008
    process_identifier: 2364
    process_handle: 0x00000080
    		1 1 0

    NtSetContextThread

    		 registers.eip: 1999372740
    registers.esp: 1638384
    registers.edi: 0
    registers.eax: 4206407
    registers.ebp: 0
    registers.edx: 0
    registers.ebx: 2130567168
    registers.esi: 0
    registers.ecx: 0
    thread_handle: 0x0000007c
    process_identifier: 2364
    		1 0 0

    NtResumeThread

    		 thread_handle: 0x0000007c
    suspend_count: 1
    process_identifier: 2364
    		1 0 0