popup
Summary | ZeroBOX
  1. Home
  2. Result
  3. Report
  4. Detail Analysis

.svchost.exe

UPX Malicious Library GIF Format PE64 PNG Format PE File DLL PE32 JPEG Format
  1. Resubmit sample
Category Machine Started Completed
FILE s1_win7_x6401 May 25, 2022, 9:40 a.m. May 25, 2022, 9:43 a.m.
Size 461.3KB
Type PE32 executable (GUI) Intel 80386, for MS Windows, Nullsoft Installer self-extracting archive
MD5 f8f22c4c4b54bb78aa18c80bf25f6cdc
SHA256 ed791c7130a52e0b4c3fc694e2955936fe0aa0052503d70caa19744de6b15baf
CRC32 629A45BC
ssdeep 12288:73nKn0c4uKYOrtGllOgds8t6YQt89VgZu:73ni0c4f7rtylOSs8N
Yara
  • IsPE32 - (no description)
  • UPX_Zero - UPX packed file
  • Malicious_Library_Zero - Malicious_Library
  • PE_Header_Zero - PE File Signature

Name Response Post-Analysis Lookup
No hosts contacted.
IP Address Status Action
No hosts contacted.

Suricata Alerts

No Suricata Alerts

Suricata TLS

No Suricata TLS

Time & API Arguments Status Return Repeated

GlobalMemoryStatusEx

 1 1 0
section .ndata
Time & API Arguments Status Return Repeated

NtProtectVirtualMemory

 process_identifier: 2784
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x739e2000
process_handle: 0xffffffff
1 0 0

NtProtectVirtualMemory

 process_identifier: 2784
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x73a85000
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2784
region_size: 1114112
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x03bb0000
allocation_type: 12288 (MEM_COMMIT|MEM_RESERVE)
process_handle: 0xffffffff
1 0 0
file C:\Users\test22\AppData\Local\Temp\nsyE485.tmp\System.dll
file C:\Users\test22\AppData\Local\Temp\System.Net.Quic.dll
file C:\Users\test22\AppData\Local\Temp\euda.lnk
Time & API Arguments Status Return Repeated

SetFileAttributesW

 file_attributes: 2 (FILE_ATTRIBUTE_HIDDEN)
filepath_r: C:\Users\test22\AppData\Local\Temp\Blresmldes242.jpg
filepath: C:\Users\test22\AppData\Local\Temp\Blresmldes242.jpg
0 0
file C:\Users\test22\AppData\Local\Temp\euda.lnk
file C:\Users\test22\AppData\Local\Temp\nsyE485.tmp\System.dll
Time & API Arguments Status Return Repeated

RegOpenKeyExW

 regkey_r: Software\Microsoft\Windows\CurrentVersion\Uninstall\Multipersonal
base_handle: 0x80000001
key_handle: 0x00000000
options: 0
access: 0x00020119
regkey: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Uninstall\Multipersonal
2 0
Lionic Trojan.Win32.GuLoader.a!c
MicroWorld-eScan Gen:Variant.Nemesis.6999
FireEye Generic.mg.f8f22c4c4b54bb78
ALYac Gen:Variant.Nemesis.6999
Cylance Unsafe
Sangfor Trojan.Win32.GuLoader.gen
K7AntiVirus Trojan-Downloader ( 0056b3281 )
BitDefender Gen:Variant.Nemesis.6999
K7GW Trojan-Downloader ( 0056b3281 )
Symantec Trojan.Gen.2
Elastic malicious (high confidence)
APEX Malicious
ClamAV Win.Dropper.Nanocore-9947074-0
Kaspersky HEUR:Trojan-Downloader.Win32.GuLoader.gen
Sophos Mal/Generic-S
DrWeb Trojan.Siggen17.56696
McAfee-GW-Edition BehavesLike.Win32.Dropper.gc
Emsisoft Gen:Variant.Nemesis.6999 (B)
Ikarus Trojan.NSIS.Agent
GData Gen:Variant.Nemesis.6999
Jiangmin Trojan.Fsysna.niv
MAX malware (ai score=89)
Kingsoft Win32.Troj.Undef.(kcloud)
Gridinsoft Ransom.Win32.Wacatac.sa
Microsoft Trojan:Win32/Wacatac.B!ml
Cynet Malicious (score: 100)
McAfee Artemis!F8F22C4C4B54
Malwarebytes Malware.AI.2883584176
MaxSecure Trojan.Malware.300983.susgen
AVG NSIS:TrojanX-gen [Trj]
Avast NSIS:TrojanX-gen [Trj]