Summary | ZeroBOX

Category	Machine	Started	Completed
FILE	s1_win7_x6401	Dec. 8, 2022, 10:40 a.m.	Dec. 8, 2022, 10:40 a.m.

Size	997.0KB
Type	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
MD5	`b22e904e9814c22f6e32667b015c6dad`
SHA256	`65d82ba3cc6d41b9aed48c3f85cd8c0bec574aec889c33a45045604f7d9c469e`
CRC32	`984EAEFB`
ssdeep	`24576:nP//SN9vvl3qrr41X649F640KV4kaoLTDMtE6fROQb8M2RP:P/qN9vvlT649F9vVrrLEaCb8M2`
Yara	ConfuserEx_Zero - Confuser .NET IsPE32 - (no description) Is_DotNET_EXE - (no description) PE_Header_Zero - PE File Signature

7s4udn5F1.exe "C:\Users\test22\AppData\Local\Temp\7s4udn5F1.exe"
2564

Name	Response	Post-Analysis Lookup
No hosts contacted.

IP Address	Status	Action
No hosts contacted.

Suricata Alerts

No Suricata Alerts

Suricata TLS

No Suricata TLS

Queries for the computername (3 events)

Time & API	Arguments	Status	Return
GetComputerNameW Dec. 8, 2022, 10:40 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameA Dec. 8, 2022, 10:40 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameW Dec. 8, 2022, 10:40 a.m.	computer_name: TEST22-PC	1	1

Checks if process is being debugged by a debugger (4 events)

Time & API	Arguments	Status	Return	Repeated
IsDebuggerPresent Dec. 8, 2022, 10:40 a.m.			0	0
IsDebuggerPresent Dec. 8, 2022, 10:40 a.m.			0	0
IsDebuggerPresent Dec. 8, 2022, 10:40 a.m.			0	0
IsDebuggerPresent Dec. 8, 2022, 10:40 a.m.			0	0

Checks amount of memory in system, this can be used to detect virtual machines that have a low amount of memory available (1 event)

Time & API	Arguments	Status	Return	Repeated
GlobalMemoryStatusEx Dec. 8, 2022, 10:40 a.m.		1	1	0

Allocates read-write-execute memory (usually to unpack itself) (50 out of 71 events)

Time & API	Arguments	Status	Return
NtAllocateVirtualMemory Dec. 8, 2022, 10:40 a.m.	process_identifier: 2564 region_size: 589824 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00380000 allocation_type: 8192 (MEM_RESERVE) process_handle: 0xffffffff	1	0
NtAllocateVirtualMemory Dec. 8, 2022, 10:40 a.m.	process_identifier: 2564 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x003d0000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1	0
NtProtectVirtualMemory Dec. 8, 2022, 10:40 a.m.	process_identifier: 2564 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x727a1000 process_handle: 0xffffffff	1	0
NtProtectVirtualMemory Dec. 8, 2022, 10:40 a.m.	process_identifier: 2564 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x727a2000 process_handle: 0xffffffff	1	0
NtAllocateVirtualMemory Dec. 8, 2022, 10:40 a.m.	process_identifier: 2564 region_size: 1769472 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00af0000 allocation_type: 8192 (MEM_RESERVE) process_handle: 0xffffffff	1	0
NtAllocateVirtualMemory Dec. 8, 2022, 10:40 a.m.	process_identifier: 2564 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00c60000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1	0
NtAllocateVirtualMemory Dec. 8, 2022, 10:40 a.m.	process_identifier: 2564 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00422000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1	0
NtAllocateVirtualMemory Dec. 8, 2022, 10:40 a.m.	process_identifier: 2564 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0043c000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1	0
NtAllocateVirtualMemory Dec. 8, 2022, 10:40 a.m.	process_identifier: 2564 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00ab0000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1	0
NtAllocateVirtualMemory Dec. 8, 2022, 10:40 a.m.	process_identifier: 2564 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00455000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1	0
NtAllocateVirtualMemory Dec. 8, 2022, 10:40 a.m.	process_identifier: 2564 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0045b000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1	0
NtAllocateVirtualMemory Dec. 8, 2022, 10:40 a.m.	process_identifier: 2564 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00457000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1	0
NtAllocateVirtualMemory Dec. 8, 2022, 10:40 a.m.	process_identifier: 2564 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00ab1000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1	0
NtAllocateVirtualMemory Dec. 8, 2022, 10:40 a.m.	process_identifier: 2564 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0043d000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1	0
NtAllocateVirtualMemory Dec. 8, 2022, 10:40 a.m.	process_identifier: 2564 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0043e000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1	0
NtAllocateVirtualMemory Dec. 8, 2022, 10:40 a.m.	process_identifier: 2564 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0043f000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1	0
NtAllocateVirtualMemory Dec. 8, 2022, 10:40 a.m.	process_identifier: 2564 region_size: 12288 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00ab2000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1	0
NtAllocateVirtualMemory Dec. 8, 2022, 10:40 a.m.	process_identifier: 2564 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00ab5000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1	0
NtAllocateVirtualMemory Dec. 8, 2022, 10:40 a.m.	process_identifier: 2564 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0042a000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1	0
NtProtectVirtualMemory Dec. 8, 2022, 10:40 a.m.	process_identifier: 2564 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 171008 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00e40400 process_handle: 0xffffffff		3221225550
NtAllocateVirtualMemory Dec. 8, 2022, 10:40 a.m.	process_identifier: 2564 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00ab6000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1	0
NtAllocateVirtualMemory Dec. 8, 2022, 10:40 a.m.	process_identifier: 2564 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00ab7000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1	0
NtAllocateVirtualMemory Dec. 8, 2022, 10:40 a.m.	process_identifier: 2564 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00ab8000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1	0
NtProtectVirtualMemory Dec. 8, 2022, 10:40 a.m.	process_identifier: 2564 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 8 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00e40178 process_handle: 0xffffffff		3221225550
NtProtectVirtualMemory Dec. 8, 2022, 10:40 a.m.	process_identifier: 2564 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 8 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00e401a0 process_handle: 0xffffffff		3221225550
NtProtectVirtualMemory Dec. 8, 2022, 10:40 a.m.	process_identifier: 2564 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 8 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00e401c8 process_handle: 0xffffffff		3221225550
NtProtectVirtualMemory Dec. 8, 2022, 10:40 a.m.	process_identifier: 2564 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 8 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00e401f0 process_handle: 0xffffffff		3221225550
NtProtectVirtualMemory Dec. 8, 2022, 10:40 a.m.	process_identifier: 2564 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 8 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00e40218 process_handle: 0xffffffff		3221225550
NtProtectVirtualMemory Dec. 8, 2022, 10:40 a.m.	process_identifier: 2564 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 11 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00e6c23e process_handle: 0xffffffff		3221225550
NtProtectVirtualMemory Dec. 8, 2022, 10:40 a.m.	process_identifier: 2564 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 11 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00e6c232 process_handle: 0xffffffff		3221225550
NtProtectVirtualMemory Dec. 8, 2022, 10:40 a.m.	process_identifier: 2564 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 72 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00e6a000 process_handle: 0xffffffff		3221225550
NtProtectVirtualMemory Dec. 8, 2022, 10:40 a.m.	process_identifier: 2564 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00e6c24c process_handle: 0xffffffff		3221225550
NtProtectVirtualMemory Dec. 8, 2022, 10:40 a.m.	process_identifier: 2564 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 8 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00e6c270 process_handle: 0xffffffff		3221225550
NtProtectVirtualMemory Dec. 8, 2022, 10:40 a.m.	process_identifier: 2564 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00e6c278 process_handle: 0xffffffff		3221225550
NtProtectVirtualMemory Dec. 8, 2022, 10:40 a.m.	process_identifier: 2564 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 8 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00e6c27c process_handle: 0xffffffff		3221225550
NtProtectVirtualMemory Dec. 8, 2022, 10:40 a.m.	process_identifier: 2564 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00e6c284 process_handle: 0xffffffff		3221225550
NtProtectVirtualMemory Dec. 8, 2022, 10:40 a.m.	process_identifier: 2564 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00e6c288 process_handle: 0xffffffff		3221225550
NtProtectVirtualMemory Dec. 8, 2022, 10:40 a.m.	process_identifier: 2564 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00e6c28c process_handle: 0xffffffff		3221225550
NtProtectVirtualMemory Dec. 8, 2022, 10:40 a.m.	process_identifier: 2564 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 8 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00e6c290 process_handle: 0xffffffff		3221225550
NtProtectVirtualMemory Dec. 8, 2022, 10:40 a.m.	process_identifier: 2564 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00e6c298 process_handle: 0xffffffff		3221225550
NtProtectVirtualMemory Dec. 8, 2022, 10:40 a.m.	process_identifier: 2564 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00e6c29c process_handle: 0xffffffff		3221225550
NtProtectVirtualMemory Dec. 8, 2022, 10:40 a.m.	process_identifier: 2564 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 8 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00e6c2a0 process_handle: 0xffffffff		3221225550
NtProtectVirtualMemory Dec. 8, 2022, 10:40 a.m.	process_identifier: 2564 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00e6c2a8 process_handle: 0xffffffff		3221225550
NtProtectVirtualMemory Dec. 8, 2022, 10:40 a.m.	process_identifier: 2564 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00e6c2ac process_handle: 0xffffffff		3221225550
NtProtectVirtualMemory Dec. 8, 2022, 10:40 a.m.	process_identifier: 2564 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 8 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00e6c2b0 process_handle: 0xffffffff		3221225550
NtProtectVirtualMemory Dec. 8, 2022, 10:40 a.m.	process_identifier: 2564 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00e6c2b8 process_handle: 0xffffffff		3221225550
NtProtectVirtualMemory Dec. 8, 2022, 10:40 a.m.	process_identifier: 2564 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00e6c2bc process_handle: 0xffffffff		3221225550
NtProtectVirtualMemory Dec. 8, 2022, 10:40 a.m.	process_identifier: 2564 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 8 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00e6c2c0 process_handle: 0xffffffff		3221225550
NtProtectVirtualMemory Dec. 8, 2022, 10:40 a.m.	process_identifier: 2564 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00e6c2c8 process_handle: 0xffffffff		3221225550
NtProtectVirtualMemory Dec. 8, 2022, 10:40 a.m.	process_identifier: 2564 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00e6c2cc process_handle: 0xffffffff		3221225550

The binary likely contains encrypted or compressed data indicative of a packer (2 events)

section

{u'size_of_data': u'0x000f8800', u'virtual_address': u'0x00002000', u'entropy': 7.9980493051173775, u'name': u'.text', u'virtual_size': u'0x000f8754'}

entropy

7.99804930512

description

A section with a high entropy has been found

entropy

0.997491219267

description

Overall entropy of this PE file is high

File has been identified by 44 AntiVirus engines on VirusTotal as malicious (44 events)

Bkav	W32.AIDetectNet.01
Lionic	Trojan.Win32.Mardom.4!c
Elastic	malicious (high confidence)
Cynet	Malicious (score: 100)
FireEye	Generic.mg.b22e904e9814c22f
McAfee	Artemis!B22E904E9814
Cylance	Unsafe
VIPRE	Gen:Trojan.Mardom.MN.14
Sangfor	Suspicious.Win32.Save.a
CrowdStrike	win/malicious_confidence_90% (W)
Alibaba	Trojan:MSIL/Mardom.15aad18c
K7GW	Spyware ( 005787ae1 )
K7AntiVirus	Spyware ( 005787ae1 )
Arcabit	Trojan.Mardom.MN.14
Symantec	ML.Attribute.HighConfidence
ESET-NOD32	multiple detections
APEX	Malicious
Kaspersky	Trojan-Spy.MSIL.Agent.thkf
BitDefender	Gen:Trojan.Mardom.MN.14
MicroWorld-eScan	Gen:Trojan.Mardom.MN.14
Avast	Win32:RATX-gen [Trj]
Tencent	Win32.Trojan.Agen.Rgil
Ad-Aware	Gen:Trojan.Mardom.MN.14
Sophos	Mal/Generic-S
McAfee-GW-Edition	BehavesLike.Win32.Generic.dc
Trapmine	malicious.moderate.ml.score
Emsisoft	Gen:Trojan.Mardom.MN.14 (B)
Ikarus	Trojan.MSIL.Spy
Gridinsoft	Ransom.Win32.Wacatac.sa
Microsoft	Trojan:Win32/Woreflint.A!cl
ZoneAlarm	Trojan-Spy.MSIL.Agent.thkf
GData	MSIL.Malware.FakeGoogle.B
Google	Detected
AhnLab-V3	Trojan/Win.Mardom.C5289703
Acronis	suspicious
BitDefenderTheta	Gen:NN.ZemsilF.34796.!m0@aS2HxVc
MAX	malware (ai score=85)
Malwarebytes	Trojan.PasswordStealer.MSIL
TrendMicro-HouseCall	TROJ_GEN.R002H0CKK22
Rising	Trojan.FakeChrome!1.9C7B (CLASSIC)
SentinelOne	Static AI - Malicious PE
Fortinet	PossibleThreat
AVG	Win32:RATX-gen [Trj]
Cybereason	malicious.4915f8

7s4udn5F1.exe

Process Tree Toggle all

Network Toggle all

Suricata Toggle all

Suricata Alerts

Suricata TLS

Signatures Toggle All