popup
Summary | ZeroBOX
  1. Home
  2. Result
  3. Report
  4. Detail Analysis

.svchost.exe

UPX Malicious Library GIF Format PE64 PNG Format PE File DLL PE32 JPEG Format
  1. Resubmit sample
Category Machine Started Completed
FILE s1_win7_x6401 May 24, 2022, 9:27 a.m. May 24, 2022, 9:33 a.m.
Size 462.3KB
Type PE32 executable (GUI) Intel 80386, for MS Windows, Nullsoft Installer self-extracting archive
MD5 def22c7200a51d7950fc5c6f8ed7b429
SHA256 ca5cc4f7922dfbfe895bf8421366260ca591ae794e04de9fbf1e3ccc2b2530db
CRC32 613B5677
ssdeep 6144:73yztmcccvScoKtAc8Vc4uKYhccKdFr4o+PV8Q8MJmzZDPgFs8t6VOXNQ1TRDQBj:73nKn0c4uKYOr4YvMU6s8t6YQt89VgZA
Yara
  • IsPE32 - (no description)
  • UPX_Zero - UPX packed file
  • Malicious_Library_Zero - Malicious_Library
  • PE_Header_Zero - PE File Signature

Name Response Post-Analysis Lookup
No hosts contacted.
IP Address Status Action
No hosts contacted.

Suricata Alerts

No Suricata Alerts

Suricata TLS

No Suricata TLS

Time & API Arguments Status Return Repeated

GlobalMemoryStatusEx

 1 1 0
section .ndata
Time & API Arguments Status Return Repeated

NtProtectVirtualMemory

 process_identifier: 2784
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x739e2000
process_handle: 0xffffffff
1 0 0

NtProtectVirtualMemory

 process_identifier: 2784
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x74305000
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2784
region_size: 1114112
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x03b50000
allocation_type: 12288 (MEM_COMMIT|MEM_RESERVE)
process_handle: 0xffffffff
1 0 0
file C:\Users\test22\AppData\Local\Temp\System.Net.Quic.dll
file C:\Users\test22\AppData\Local\Temp\nscE0EB.tmp\System.dll
file C:\Users\test22\AppData\Local\Temp\euda.lnk
Time & API Arguments Status Return Repeated

SetFileAttributesW

 file_attributes: 2 (FILE_ATTRIBUTE_HIDDEN)
filepath_r: C:\Users\test22\AppData\Local\Temp\Blresmldes242.jpg
filepath: C:\Users\test22\AppData\Local\Temp\Blresmldes242.jpg
0 0
file C:\Users\test22\AppData\Local\Temp\euda.lnk
file C:\Users\test22\AppData\Local\Temp\nscE0EB.tmp\System.dll
Time & API Arguments Status Return Repeated

RegOpenKeyExW

 regkey_r: Software\Microsoft\Windows\CurrentVersion\Uninstall\Multipersonal
base_handle: 0x80000001
key_handle: 0x00000000
options: 0
access: 0x00020119
regkey: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Uninstall\Multipersonal
2 0
Lionic Trojan.Multi.Generic.4!c
Elastic malicious (high confidence)
MicroWorld-eScan Gen:Variant.Nemesis.6999
FireEye Generic.mg.def22c7200a51d79
Sangfor Riskware.Win32.Agent.ky
Symantec Trojan.Gen.2
APEX Malicious
Avast FileRepMalware [Misc]
ClamAV Win.Dropper.Nanocore-9947074-0
Kaspersky HEUR:Trojan-Downloader.Win32.GuLoader.gen
BitDefender Gen:Variant.Nemesis.6999
DrWeb Trojan.Siggen17.56696
McAfee-GW-Edition BehavesLike.Win32.Dropper.gc
Jiangmin Trojan.Fsysna.niv
Kingsoft Win32.Troj.Undef.(kcloud)
GData Gen:Variant.Nemesis.6999
Cynet Malicious (score: 100)
McAfee Artemis!DEF22C7200A5
MaxSecure Trojan.Malware.300983.susgen
AVG FileRepMalware [Misc]