Summary | ZeroBOX

Category	Machine	Started	Completed
FILE	s1_win7_x6403_us	May 20, 2022, 1:17 p.m.	May 20, 2022, 1:32 p.m.

Size	307.3KB
Type	PE32 executable (GUI) Intel 80386, for MS Windows, Nullsoft Installer self-extracting archive
MD5	`aee375e4146251b66ba38231c842eb87`
SHA256	`03699cd011bc2bdcc11cc6edb6b87a6a005154e4670062140f1953c6de1d7488`
CRC32	`C6B44150`
ssdeep	`6144:POtIwK1VfaoyYkIk+rZGYDRubPr6SWiYnlLJiLIzxW:POWMoyYkIkMpSWi7LEA`
Yara	IsPE32 - (no description) UPX_Zero - UPX packed file Malicious_Library_Zero - Malicious_Library PE_Header_Zero - PE File Signature

domla.exe "C:\Users\test22\AppData\Local\Temp\domla.exe"
2304
- jtddr.exe C:\Users\test22\AppData\Local\Temp\jtddr.exe C:\Users\test22\AppData\Local\Temp\zyonm
  2412
  - jtddr.exe C:\Users\test22\AppData\Local\Temp\jtddr.exe C:\Users\test22\AppData\Local\Temp\zyonm
    2476

Name	Response	Post-Analysis Lookup
www.c8wl4.icu	A 192.151.226.170	192.151.226.170
www.thedirectmedia.com
www.vs368.com	A 156.234.222.237	156.234.222.237
www.fastted.info

IP Address	Status	Action
156.234.222.237	Active	Moloch
164.124.101.2	Active	Moloch
192.151.226.170	Active	Moloch

Suricata Alerts

Flow	SID	Signature	Category
TCP 192.168.56.103:49165 -> 156.234.222.237:80	2031412	ET MALWARE FormBook CnC Checkin (GET)	Malware Command and Control Activity Detected
UDP 192.168.56.103:63183 -> 164.124.101.2:53	2026888	ET INFO DNS Query for Suspicious .icu Domain	Potentially Bad Traffic
TCP 192.168.56.103:49165 -> 156.234.222.237:80	2031449	ET MALWARE FormBook CnC Checkin (GET)	Malware Command and Control Activity Detected
TCP 192.168.56.103:49165 -> 156.234.222.237:80	2031453	ET MALWARE FormBook CnC Checkin (GET)	Malware Command and Control Activity Detected
TCP 192.168.56.103:49171 -> 192.151.226.170:80	2031412	ET MALWARE FormBook CnC Checkin (GET)	Malware Command and Control Activity Detected
TCP 192.168.56.103:49171 -> 192.151.226.170:80	2031449	ET MALWARE FormBook CnC Checkin (GET)	Malware Command and Control Activity Detected
TCP 192.168.56.103:49171 -> 192.151.226.170:80	2031453	ET MALWARE FormBook CnC Checkin (GET)	Malware Command and Control Activity Detected

Suricata TLS

No Suricata TLS

Checks amount of memory in system, this can be used to detect virtual machines that have a low amount of memory available (1 event)

Time & API	Arguments	Status	Return	Repeated
GlobalMemoryStatusEx May 20, 2022, 1:17 p.m.		1	1	0

The executable contains unknown PE section names indicative of a packer (could be a false positive) (1 event)

section

.ndata

HTTP traffic contains suspicious features which may be indicative of malware related traffic (1 event)

suspicious_features

GET method with no useragent header

suspicious_request

GET http://www.vs368.com/sh30/?ElS=H4tMHU755tPJ5yzd3Ew6DVGstGcr6734abZdejQYMRhvD/07Sx7qYkYpXzn94LNWSvgEvl3U&Qtu=JlzpxZHpbLV

Performs some HTTP requests (1 event)

request

GET http://www.vs368.com/sh30/?ElS=H4tMHU755tPJ5yzd3Ew6DVGstGcr6734abZdejQYMRhvD/07Sx7qYkYpXzn94LNWSvgEvl3U&Qtu=JlzpxZHpbLV

Allocates read-write-execute memory (usually to unpack itself) (2 events)

Time & API	Arguments	Status	Return	Repeated
NtAllocateVirtualMemory May 20, 2022, 1:17 p.m.	process_identifier: 2412 region_size: 8192 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00810000 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0xffffffff	1	0	0
NtAllocateVirtualMemory May 20, 2022, 1:17 p.m.	process_identifier: 2476 region_size: 3158016 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00820000 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0xffffffff	1	0	0

Creates executable files on the filesystem (1 event)

file	C:\Users\test22\AppData\Local\Temp\jtddr.exe

Checks for the Locally Unique Identifier on the system for a suspicious privilege (1 event)

Time & API	Arguments	Status	Return	Repeated
LookupPrivilegeValueW May 20, 2022, 1:17 p.m.	system_name: privilege_name: SeDebugPrivilege	1	1	0

Allocates execute permission to another process indicative of possible code injection (1 event)

Time & API	Arguments	Status	Return	Repeated
NtAllocateVirtualMemory May 20, 2022, 1:17 p.m.	process_identifier: 2476 region_size: 192512 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00400000 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0x00000124	1	0	0

Used NtSetContextThread to modify a thread in a remote process indicative of process injection (2 events)

Time & API	Arguments	Status	Return	Repeated
Process injection	Process 2412 called NtSetContextThread to modify thread in remote process 2476
NtSetContextThread May 20, 2022, 1:17 p.m.	registers.eip: 1999372740 registers.esp: 1638384 registers.edi: 0 registers.eax: 4321344 registers.ebp: 0 registers.edx: 0 registers.ebx: 2130567168 registers.esi: 0 registers.ecx: 0 thread_handle: 0x00000120 process_identifier: 2476	1	0	0

Executed a process and injected code into it, probably while unpacking (5 events)

Time & API	Arguments	Status	Return
CreateProcessInternalW May 20, 2022, 1:17 p.m.	thread_identifier: 2416 thread_handle: 0x000001fc process_identifier: 2412 current_directory: filepath: track: 1 command_line: C:\Users\test22\AppData\Local\Temp\jtddr.exe C:\Users\test22\AppData\Local\Temp\zyonm filepath_r: stack_pivoted: 0 creation_flags: 67108864 (CREATE_DEFAULT_ERROR_MODE) inherit_handles: 0 process_handle: 0x000001f4	1	1
CreateProcessInternalW May 20, 2022, 1:17 p.m.	thread_identifier: 2480 thread_handle: 0x00000120 process_identifier: 2476 current_directory: filepath: C:\Users\test22\AppData\Local\Temp\jtddr.exe track: 1 command_line: C:\Users\test22\AppData\Local\Temp\jtddr.exe C:\Users\test22\AppData\Local\Temp\zyonm filepath_r: C:\Users\test22\AppData\Local\Temp\jtddr.exe stack_pivoted: 0 creation_flags: 134217732 (CREATE_NO_WINDOW\|CREATE_SUSPENDED) inherit_handles: 0 process_handle: 0x00000124	1	1
NtGetContextThread May 20, 2022, 1:17 p.m.	thread_handle: 0x00000120	1	0
NtAllocateVirtualMemory May 20, 2022, 1:17 p.m.	process_identifier: 2476 region_size: 192512 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00400000 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0x00000124	1	0
NtSetContextThread May 20, 2022, 1:17 p.m.	registers.eip: 1999372740 registers.esp: 1638384 registers.edi: 0 registers.eax: 4321344 registers.ebp: 0 registers.edx: 0 registers.ebx: 2130567168 registers.esi: 0 registers.ecx: 0 thread_handle: 0x00000120 process_identifier: 2476	1	0

File has been identified by 36 AntiVirus engines on VirusTotal as malicious (36 events)

Bkav	W32.AIDetect.malware2
Lionic	Trojan.Win32.Jaik.4!c
Elastic	malicious (high confidence)
MicroWorld-eScan	Gen:Variant.Jaik.72878
McAfee	Artemis!AEE375E41462
Cylance	Unsafe
Sangfor	Trojan.Win32.Save.a
CrowdStrike	win/malicious_confidence_100% (W)
BitDefender	Gen:Variant.Jaik.72878
K7GW	Trojan ( 005930c31 )
Cyren	W32/Ninjector.BB.gen!Eldorado
Symantec	ML.Attribute.HighConfidence
ESET-NOD32	a variant of Win32/Injector.ERQY
Paloalto	generic.ml
Cynet	Malicious (score: 100)
Kaspersky	HEUR:Trojan.Win32.Injexa.gen
Alibaba	Trojan:Win32/Lokibot.ff06aab9
Rising	Trojan.Generic@AI.84 (RDML:xgL/TN3hVGUMOM8xncdNFw)
Ad-Aware	Gen:Variant.Jaik.72878
Sophos	Mal/Generic-S
McAfee-GW-Edition	BehavesLike.Win32.Dropper.fc
SentinelOne	Static AI - Suspicious PE
FireEye	Generic.mg.aee375e4146251b6
Emsisoft	Gen:Variant.Jaik.72878 (B)
APEX	Malicious
Jiangmin	Trojan.Fsysna.niy
Gridinsoft	Ransom.Win32.Sabsik.oa!s1
Microsoft	Trojan:Win32/Lokibot.ANRI!MTB
GData	Gen:Variant.Jaik.72878
ALYac	Gen:Variant.Jaik.72878
MAX	malware (ai score=80)
Ikarus	Trojan.NSIS.Agent
Fortinet	W32/Injector.ERQY!tr
AVG	Win32:PWSX-gen [Trj]
Cybereason	malicious.7e0c75
Avast	Win32:PWSX-gen [Trj]

domla.exe

Process Tree Toggle all

Network Toggle all

Suricata Toggle all

Suricata Alerts

Suricata TLS

Signatures Toggle All