Summary | ZeroBOX

Category	Machine	Started	Completed
FILE	s1_win7_x6401	May 19, 2022, 11:10 a.m.	May 19, 2022, 11:20 a.m.

Size	214.2KB
Type	PE32 executable (GUI) Intel 80386, for MS Windows, Nullsoft Installer self-extracting archive
MD5	`dd6738b8bd7f1450c7c21f6bd71b6fa2`
SHA256	`58dc8fe3046450ddf0e00d1076440c4357f46a6829c41b85f8aa0345d51887c7`
CRC32	`DB310B54`
ssdeep	`3072:VfY/TU9fE9PEtunb8z/nbBaC3oGfkmR5ooWj/+nswgLPoHp/kkUhfL0h3smO/v1g:ZYa6V8z/nNIGfkGoo8zNPKp0lQ5sF187`
Yara	IsPE32 - (no description) UPX_Zero - UPX packed file Malicious_Library_Zero - Malicious_Library PE_Header_Zero - PE File Signature

dj.exe "C:\Users\test22\AppData\Local\Temp\dj.exe"
2776
- xbbljvli.exe C:\Users\test22\AppData\Local\Temp\xbbljvli.exe C:\Users\test22\AppData\Local\Temp\kviylkodr
  2872
  - xbbljvli.exe C:\Users\test22\AppData\Local\Temp\xbbljvli.exe C:\Users\test22\AppData\Local\Temp\kviylkodr
    2936

Name	Response	Post-Analysis Lookup
www.davispp.com	A 34.102.136.180 CNAME davispp.com	34.102.136.180
www.tzxc3441.xyz	A 107.161.23.204 A 198.251.84.92 A 70.39.125.244 A 45.58.190.82 A 64.32.22.102 A 198.251.81.30 A 204.188.203.155 A 209.141.38.71 A 192.161.187.200 CNAME parking.namesilo.com A 168.235.88.209	107.161.23.204
www.fastonlineprescriptions.com	A 64.98.145.30	64.98.145.30
www.ontopoetics.com	CNAME ontopoetics.com A 34.102.136.180	34.102.136.180

IP Address	Status	Action
172.67.188.70	Active	Moloch
164.124.101.2	Active	Moloch
209.141.38.71	Active	Moloch
34.102.136.180	Active	Moloch
64.98.145.30	Active	Moloch

Suricata Alerts

Flow	SID	Signature	Category
TCP 192.168.56.101:49167 -> 34.102.136.180:80	2031412	ET MALWARE FormBook CnC Checkin (GET)	Malware Command and Control Activity Detected
TCP 192.168.56.101:49167 -> 34.102.136.180:80	2031449	ET MALWARE FormBook CnC Checkin (GET)	Malware Command and Control Activity Detected
TCP 192.168.56.101:49167 -> 34.102.136.180:80	2031453	ET MALWARE FormBook CnC Checkin (GET)	Malware Command and Control Activity Detected
TCP 192.168.56.101:49168 -> 34.102.136.180:80	2031412	ET MALWARE FormBook CnC Checkin (GET)	Malware Command and Control Activity Detected
TCP 192.168.56.101:49168 -> 34.102.136.180:80	2031449	ET MALWARE FormBook CnC Checkin (GET)	Malware Command and Control Activity Detected
TCP 192.168.56.101:49168 -> 34.102.136.180:80	2031453	ET MALWARE FormBook CnC Checkin (GET)	Malware Command and Control Activity Detected
TCP 192.168.56.101:49166 -> 64.98.145.30:80	2031412	ET MALWARE FormBook CnC Checkin (GET)	Malware Command and Control Activity Detected
TCP 192.168.56.101:49166 -> 64.98.145.30:80	2031449	ET MALWARE FormBook CnC Checkin (GET)	Malware Command and Control Activity Detected
TCP 192.168.56.101:49166 -> 64.98.145.30:80	2031453	ET MALWARE FormBook CnC Checkin (GET)	Malware Command and Control Activity Detected
TCP 192.168.56.101:49169 -> 209.141.38.71:80	2031412	ET MALWARE FormBook CnC Checkin (GET)	Malware Command and Control Activity Detected
TCP 192.168.56.101:49169 -> 209.141.38.71:80	2031449	ET MALWARE FormBook CnC Checkin (GET)	Malware Command and Control Activity Detected
TCP 192.168.56.101:49169 -> 209.141.38.71:80	2031453	ET MALWARE FormBook CnC Checkin (GET)	Malware Command and Control Activity Detected
TCP 192.168.56.101:49169 -> 209.141.38.71:80	2031088	ET HUNTING Request to .XYZ Domain with Minimal Headers	Potentially Bad Traffic

Suricata TLS

No Suricata TLS

Checks amount of memory in system, this can be used to detect virtual machines that have a low amount of memory available (1 event)

Time & API	Arguments	Status	Return	Repeated
GlobalMemoryStatusEx May 19, 2022, 11:10 a.m.		1	1	0

The executable contains unknown PE section names indicative of a packer (could be a false positive) (1 event)

section

.ndata

HTTP traffic contains suspicious features which may be indicative of malware related traffic (4 events)

suspicious_features	GET method with no useragent header	suspicious_request	GET http://www.fastonlineprescriptions.com/lt17/?jFN8ld=73rk+orgEpy27+zMAaMQJFeW88Y512m4PCXKYgKW50mcSxWU82Z5cEbtPVfpZQYZiaxiMB9D&Ppm=_0GDCjlXRtrXu
suspicious_features	GET method with no useragent header	suspicious_request	GET http://www.davispp.com/lt17/?jFN8ld=3vga1QHbs5IZQDecmeBRzvB7X4cN9V512nUQDaYLNb3NDtIUZSfjVgh1loWuVKPGH5opG13N&Ppm=_0GDCjlXRtrXu
suspicious_features	GET method with no useragent header	suspicious_request	GET http://www.ontopoetics.com/lt17/?jFN8ld=nZgEXS+oZtvzQ5r51wVjH6BjRJ2Rw1axQ+lriXHyh4vc/hxz0aIffk2tcbCYWJV+PA0U6TQR&Ppm=_0GDCjlXRtrXu
suspicious_features	GET method with no useragent header	suspicious_request	GET http://www.tzxc3441.xyz/lt17/?jFN8ld=CsYv+VTVNUh00Baw9JVYtpO333zQB1BV7Yd43ApDKy0wiwpbKszaan16DSpNCvzEWgZesUAC&Ppm=_0GDCjlXRtrXu

Performs some HTTP requests (4 events)

request	GET http://www.fastonlineprescriptions.com/lt17/?jFN8ld=73rk+orgEpy27+zMAaMQJFeW88Y512m4PCXKYgKW50mcSxWU82Z5cEbtPVfpZQYZiaxiMB9D&Ppm=_0GDCjlXRtrXu
request	GET http://www.davispp.com/lt17/?jFN8ld=3vga1QHbs5IZQDecmeBRzvB7X4cN9V512nUQDaYLNb3NDtIUZSfjVgh1loWuVKPGH5opG13N&Ppm=_0GDCjlXRtrXu
request	GET http://www.ontopoetics.com/lt17/?jFN8ld=nZgEXS+oZtvzQ5r51wVjH6BjRJ2Rw1axQ+lriXHyh4vc/hxz0aIffk2tcbCYWJV+PA0U6TQR&Ppm=_0GDCjlXRtrXu
request	GET http://www.tzxc3441.xyz/lt17/?jFN8ld=CsYv+VTVNUh00Baw9JVYtpO333zQB1BV7Yd43ApDKy0wiwpbKszaan16DSpNCvzEWgZesUAC&Ppm=_0GDCjlXRtrXu

Allocates read-write-execute memory (usually to unpack itself) (3 events)

Time & API	Arguments	Status
NtProtectVirtualMemory May 19, 2022, 11:10 a.m.	process_identifier: 2776 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x739e2000 process_handle: 0xffffffff	1
NtAllocateVirtualMemory May 19, 2022, 11:10 a.m.	process_identifier: 2872 region_size: 8192 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00980000 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0xffffffff	1
NtAllocateVirtualMemory May 19, 2022, 11:10 a.m.	process_identifier: 2936 region_size: 3158016 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00ba0000 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0xffffffff	1

Creates executable files on the filesystem (1 event)

file	C:\Users\test22\AppData\Local\Temp\xbbljvli.exe

Checks for the Locally Unique Identifier on the system for a suspicious privilege (1 event)

Time & API	Arguments	Status	Return	Repeated
LookupPrivilegeValueW May 19, 2022, 11:10 a.m.	system_name: privilege_name: SeDebugPrivilege	1	1	0

Communicates with host for which no DNS query was performed (1 event)

host

172.67.188.70

Allocates execute permission to another process indicative of possible code injection (1 event)

Time & API	Arguments	Status	Return	Repeated
NtAllocateVirtualMemory May 19, 2022, 11:10 a.m.	process_identifier: 2936 region_size: 192512 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00400000 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0x000000f0	1	0	0

Used NtSetContextThread to modify a thread in a remote process indicative of process injection (2 events)

Time & API	Arguments	Status	Return	Repeated
Process injection	Process 2872 called NtSetContextThread to modify thread in remote process 2936
NtSetContextThread May 19, 2022, 11:10 a.m.	registers.eip: 2003108292 registers.esp: 3800560 registers.edi: 0 registers.eax: 4321664 registers.ebp: 0 registers.edx: 0 registers.ebx: 2130567168 registers.esi: 0 registers.ecx: 0 thread_handle: 0x000000ec process_identifier: 2936	1	0	0

Executed a process and injected code into it, probably while unpacking (5 events)

Time & API	Arguments	Status	Return
CreateProcessInternalW May 19, 2022, 11:10 a.m.	thread_identifier: 2876 thread_handle: 0x000001f4 process_identifier: 2872 current_directory: filepath: track: 1 command_line: C:\Users\test22\AppData\Local\Temp\xbbljvli.exe C:\Users\test22\AppData\Local\Temp\kviylkodr filepath_r: stack_pivoted: 0 creation_flags: 67108864 (CREATE_DEFAULT_ERROR_MODE) inherit_handles: 0 process_handle: 0x000001fc	1	1
CreateProcessInternalW May 19, 2022, 11:10 a.m.	thread_identifier: 2940 thread_handle: 0x000000ec process_identifier: 2936 current_directory: filepath: C:\Users\test22\AppData\Local\Temp\xbbljvli.exe track: 1 command_line: C:\Users\test22\AppData\Local\Temp\xbbljvli.exe C:\Users\test22\AppData\Local\Temp\kviylkodr filepath_r: C:\Users\test22\AppData\Local\Temp\xbbljvli.exe stack_pivoted: 0 creation_flags: 134217732 (CREATE_NO_WINDOW\|CREATE_SUSPENDED) inherit_handles: 0 process_handle: 0x000000f0	1	1
NtGetContextThread May 19, 2022, 11:10 a.m.	thread_handle: 0x000000ec	1	0
NtAllocateVirtualMemory May 19, 2022, 11:10 a.m.	process_identifier: 2936 region_size: 192512 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00400000 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0x000000f0	1	0
NtSetContextThread May 19, 2022, 11:10 a.m.	registers.eip: 2003108292 registers.esp: 3800560 registers.edi: 0 registers.eax: 4321664 registers.ebp: 0 registers.edx: 0 registers.ebx: 2130567168 registers.esi: 0 registers.ecx: 0 thread_handle: 0x000000ec process_identifier: 2936	1	0

File has been identified by 41 AntiVirus engines on VirusTotal as malicious (41 events)

DrWeb	Trojan.Siggen17.52874
MicroWorld-eScan	Trojan.NSISX.Spy.Gen.2
FireEye	Generic.mg.dd6738b8bd7f1450
ALYac	Gen:Variant.Ulise.361632
Malwarebytes	Trojan.Injector
Sangfor	[NULLSOFT PIMP INSTALL SYSTEM2]
Alibaba	Trojan:Win32/Lokibot.3241a54f
K7GW	Trojan ( 00592f9f1 )
Cybereason	malicious.58a8f9
BitDefenderTheta	Gen:NN.ZexaE.34682.amW@aiLM1dg
Cyren	W32/Trojan.QQUK-5462
Symantec	ML.Attribute.HighConfidence
Elastic	malicious (high confidence)
ESET-NOD32	a variant of Win32/Injector.ERQS
TrendMicro-HouseCall	TROJ_FRS.0NA104EI22
Paloalto	generic.ml
Kaspersky	HEUR:Trojan-Spy.Win32.Noon.gen
BitDefender	Trojan.NSISX.Spy.Gen.2
Avast	Win32:InjectorX-gen [Trj]
Tencent	Win32.Trojan-spy.Noon.Wtnj
Emsisoft	Trojan.NSISX.Spy.Gen.2 (B)
McAfee-GW-Edition	BehavesLike.Win32.Dropper.dc
Sophos	Mal/Generic-S
Ikarus	Trojan-Spy.Agent
Kingsoft	Win32.Troj.Undef.(kcloud)
Microsoft	Trojan:Win32/Lokibot.ANRF!MTB
ZoneAlarm	HEUR:Trojan-Spy.Win32.Noon.gen
GData	Gen:Variant.Ulise.361632
Cynet	Malicious (score: 100)
AhnLab-V3	Trojan/Win.NSISInject.R492809
Acronis	suspicious
McAfee	Artemis!DD6738B8BD7F
MAX	malware (ai score=80)
VBA32	BScope.Trojan.Winlock
Cylance	Unsafe
APEX	Malicious
Rising	Trojan.Injector!8.C4 (CLOUD)
SentinelOne	Static AI - Malicious PE
Fortinet	W32/Agent.ERNF!tr
AVG	Win32:InjectorX-gen [Trj]
CrowdStrike	win/malicious_confidence_90% (W)

dj.exe

Process Tree Toggle all

Network Toggle all

Suricata Toggle all

Suricata Alerts

Suricata TLS

Signatures Toggle All