Summary | ZeroBOX

Category	Machine	Started	Completed
FILE	s1_win7_x6403_us	May 25, 2022, 9:40 a.m.	May 25, 2022, 9:46 a.m.

Size	3.3MB
Type	PE32 executable (GUI) Intel 80386, for MS Windows, RAR self-extracting archive
MD5	`fa47b24566cb07aa26b215f121cb8758`
SHA256	`8b0026b4196e9fc3c5b7e653d44aa5c1fc5b81af77eb3e9810722189349f0b90`
CRC32	`410AB256`
ssdeep	`98304:JSIRAP7cX2bwkJJMNKd76KbCZfFBye+L4VJPxFbu:M/P7dMiJbCV4Lgbhu`
PDB Path	d:\Projects\WinRAR\SFX\build\sfxrar32\Release\sfxrar.pdb
Yara	IsPE32 - (no description) UPX_Zero - UPX packed file Malicious_Library_Zero - Malicious_Library PE_Header_Zero - PE File Signature

ideainv.sfx.exe "C:\Users\test22\AppData\Local\Temp\ideainv.sfx.exe"
2372

Name	Response	Post-Analysis Lookup
No hosts contacted.

IP Address	Status	Action
164.124.101.2	Active	Moloch
193.142.58.21	Active	Moloch

Suricata Alerts

No Suricata Alerts

Suricata TLS

No Suricata TLS

This executable has a PDB path (1 event)

pdb_path

d:\Projects\WinRAR\SFX\build\sfxrar32\Release\sfxrar.pdb

Checks amount of memory in system, this can be used to detect virtual machines that have a low amount of memory available (1 event)

Time & API	Arguments	Status	Return	Repeated
GlobalMemoryStatusEx May 25, 2022, 9:40 a.m.		1	1	0

Allocates read-write-execute memory (usually to unpack itself) (20 events)

Time & API	Arguments	Status
NtProtectVirtualMemory May 25, 2022, 9:40 a.m.	process_identifier: 2372 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x73ca1000 process_handle: 0xffffffff	1
NtProtectVirtualMemory May 25, 2022, 9:40 a.m.	process_identifier: 2372 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x73c81000 process_handle: 0xffffffff	1
NtProtectVirtualMemory May 25, 2022, 9:40 a.m.	process_identifier: 2372 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x76741000 process_handle: 0xffffffff	1
NtProtectVirtualMemory May 25, 2022, 9:40 a.m.	process_identifier: 2372 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x75981000 process_handle: 0xffffffff	1
NtProtectVirtualMemory May 25, 2022, 9:40 a.m.	process_identifier: 2372 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x73a91000 process_handle: 0xffffffff	1
NtProtectVirtualMemory May 25, 2022, 9:40 a.m.	process_identifier: 2372 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x73a51000 process_handle: 0xffffffff	1
NtProtectVirtualMemory May 25, 2022, 9:40 a.m.	process_identifier: 2372 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x74d71000 process_handle: 0xffffffff	1
NtProtectVirtualMemory May 25, 2022, 9:40 a.m.	process_identifier: 2372 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x756b1000 process_handle: 0xffffffff	1
NtProtectVirtualMemory May 25, 2022, 9:40 a.m.	process_identifier: 2372 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x75451000 process_handle: 0xffffffff	1
NtProtectVirtualMemory May 25, 2022, 9:40 a.m.	process_identifier: 2372 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x75681000 process_handle: 0xffffffff	1
NtProtectVirtualMemory May 25, 2022, 9:40 a.m.	process_identifier: 2372 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x73951000 process_handle: 0xffffffff	1
NtProtectVirtualMemory May 25, 2022, 9:40 a.m.	process_identifier: 2372 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x73841000 process_handle: 0xffffffff	1
NtProtectVirtualMemory May 25, 2022, 9:40 a.m.	process_identifier: 2372 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x737b1000 process_handle: 0xffffffff	1
NtProtectVirtualMemory May 25, 2022, 9:40 a.m.	process_identifier: 2372 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x75551000 process_handle: 0xffffffff	1
NtProtectVirtualMemory May 25, 2022, 9:40 a.m.	process_identifier: 2372 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x74bc1000 process_handle: 0xffffffff	1
NtProtectVirtualMemory May 25, 2022, 9:40 a.m.	process_identifier: 2372 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x73781000 process_handle: 0xffffffff	1
NtProtectVirtualMemory May 25, 2022, 9:40 a.m.	process_identifier: 2372 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x73741000 process_handle: 0xffffffff	1
NtProtectVirtualMemory May 25, 2022, 9:40 a.m.	process_identifier: 2372 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x71a31000 process_handle: 0xffffffff	1
NtProtectVirtualMemory May 25, 2022, 9:40 a.m.	process_identifier: 2372 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x71931000 process_handle: 0xffffffff	1
NtProtectVirtualMemory May 25, 2022, 9:40 a.m.	process_identifier: 2372 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x71821000 process_handle: 0xffffffff	1

Creates (office) documents on the filesystem (2 events)

file	C:\Users\test22\AppData\Local\Temp\ITC04.xlsm
file	C:\Users\test22\AppData\Local\Temp\EXPORT.xls

Creates executable files on the filesystem (1 event)

file	C:\Users\test22\AppData\Local\Temp\ideainv.EXE

Drops an executable to the user AppData folder (1 event)

file	C:\Users\test22\AppData\Local\Temp\ideainv.EXE

Changes read-write memory protection to read-execute (probably to avoid detection when setting all RWX flags at the same time) (1 event)

Time & API	Arguments	Status	Return	Repeated
NtProtectVirtualMemory May 25, 2022, 9:40 a.m.	process_identifier: 2372 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 length: 4096 protection: 32 (PAGE_EXECUTE_READ) base_address: 0x7ef90000 process_handle: 0xffffffff	1	0	0

Communicates with host for which no DNS query was performed (1 event)

host

193.142.58.21

File has been identified by 16 AntiVirus engines on VirusTotal as malicious (16 events)

Bkav	W32.AIDetect.malware2
MicroWorld-eScan	Trojan.GenericKD.49037226
McAfee	Artemis!FA47B24566CB
Arcabit	Trojan.Generic.D2EC3FAA
Elastic	malicious (moderate confidence)
APEX	Malicious
ClamAV	Win.Trojan.Bicololo-11
BitDefender	Trojan.GenericKD.49037226
Ad-Aware	Trojan.GenericKD.49037226
McAfee-GW-Edition	BehavesLike.Win32.Dropper.wc
FireEye	Trojan.GenericKD.49037226
Emsisoft	Trojan.GenericKD.49037226 (B)
GData	Trojan.GenericKD.49037226
ALYac	Trojan.GenericKD.49037226
TrendMicro-HouseCall	TROJ_GEN.R002H09EO22
MAX	malware (ai score=85)

ideainv.sfx.exe

Process Tree Toggle all

Network Toggle all

Suricata Toggle all

Suricata Alerts

Suricata TLS

Signatures Toggle All