Summary | ZeroBOX

Category	Machine	Started	Completed
FILE	s1_win7_x6401	Dec. 13, 2022, 5:11 p.m.	Dec. 13, 2022, 5:26 p.m.

Size	1.5MB
Type	PE32 executable (GUI) Intel 80386, for MS Windows
MD5	`74ec11c582f37ac01c64d7d272e924fe`
SHA256	`8b7011f3551a3ba449d06b7b26830ff0a66861fb22cbd50454d8f9297f2bf362`
CRC32	`DA9863D0`
ssdeep	`24576:l7LZ7EeJEjNKrKvH1q5IXCm87+eQ6R5Px+lCYoyiezz9+cxBge2PqQAWD:vWCKvH1q5ISP7+BU+l4yaD`
PDB Path	C:\dar\gos_hicedaxi\cele\quimojo\Roxopol.pdb
Yara	IsPE32 - (no description) OS_Processor_Check_Zero - OS Processor Check Malicious_Library_Zero - Malicious_Library PE_Header_Zero - PE File Signature UPX_Zero - UPX packed file

setup.exe "C:\Users\test22\AppData\Local\Temp\setup.exe"
2608

Name	Response	Post-Analysis Lookup
fyyhgnqeknid5wan.vxsq2hxc5q61qlncqtwrwsv06

IP Address	Status	Action
164.124.101.2	Active	Moloch

Suricata Alerts

No Suricata Alerts

Suricata TLS

No Suricata TLS

Queries for the computername (1 event)

Time & API	Arguments	Status	Return	Repeated
GetComputerNameW Dec. 13, 2022, 5:11 p.m.	computer_name: TEST22-PC	1	1	0

Checks if process is being debugged by a debugger (1 event)

Time & API	Arguments	Status	Return	Repeated
IsDebuggerPresent Dec. 13, 2022, 5:11 p.m.			0	0

This executable has a PDB path (1 event)

pdb_path

C:\dar\gos_hicedaxi\cele\quimojo\Roxopol.pdb

One or more potentially interesting buffers were extracted, these generally contain injected code, configuration data, etc.

Allocates read-write-execute memory (usually to unpack itself) (4 events)

Time & API	Arguments	Status
NtAllocateVirtualMemory Dec. 13, 2022, 5:11 p.m.	process_identifier: 2608 region_size: 1310720 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x027f0000 allocation_type: 8192 (MEM_RESERVE) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Dec. 13, 2022, 5:11 p.m.	process_identifier: 2608 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x028f0000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Dec. 13, 2022, 5:11 p.m.	process_identifier: 2608 region_size: 1265664 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x02930000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtProtectVirtualMemory Dec. 13, 2022, 5:11 p.m.	process_identifier: 2608 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 length: 3104768 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x10e70000 process_handle: 0xffffffff	1

Searches running processes potentially to identify processes for sandbox evasion, code injection or memory dumping (5 events)

Time & API	Arguments	Status	Return
Process32NextW Dec. 13, 2022, 5:11 p.m.	snapshot_handle: 0x0000010c process_name: wsqmcons.exe process_identifier: 2408	1	1
Process32NextW Dec. 13, 2022, 5:11 p.m.	snapshot_handle: 0x0000010c process_name: taskhost.exe process_identifier: 2424	1	1
Process32NextW Dec. 13, 2022, 5:11 p.m.	snapshot_handle: 0x0000010c process_name: setup.exe process_identifier: 2608	1	1
Process32NextW Dec. 13, 2022, 5:11 p.m.	snapshot_handle: 0x0000010c process_name: schtasks.exe process_identifier: 2660	1	1
Process32NextW Dec. 13, 2022, 5:11 p.m.	snapshot_handle: 0x0000010c process_name: conhost.exe process_identifier: 2668	1	1

The binary likely contains encrypted or compressed data indicative of a packer (3 events)

section

{u'size_of_data': u'0x00149400', u'virtual_address': u'0x00001000', u'entropy': 7.914285422607883, u'name': u'.text', u'virtual_size': u'0x001493d1'}

entropy

7.91428542261

description

A section with a high entropy has been found

section

{u'size_of_data': u'0x00024c00', u'virtual_address': u'0x003b9000', u'entropy': 7.472733621630449, u'name': u'.rsrc', u'virtual_size': u'0x00024b48'}

entropy

7.47273362163

description

A section with a high entropy has been found

entropy

0.974700399467

description

Overall entropy of this PE file is high

One or more of the buffers contains an embedded PE file (1 event)

buffer

Buffer with sha1: 77586c58786829429309900f9de7956ced0d84d9

File has been identified by 29 AntiVirus engines on VirusTotal as malicious (29 events)

Bkav	W32.AIDetect.malware2
Elastic	malicious (high confidence)
Cynet	Malicious (score: 100)
FireEye	Generic.mg.74ec11c582f37ac0
McAfee	Artemis!74EC11C582F3
Cylance	Unsafe
Sangfor	Trojan.Win32.Agent.Anya
Alibaba	Trojan:Win32/Strab.6129fe1c
Arcabit	Trojan.Tedy.D3E995
BitDefenderTheta	Gen:NN.ZexaF.36106.EvX@ae@SePoO
Symantec	ML.Attribute.HighConfidence
ESET-NOD32	a variant of Win32/GenKryptik.GDOD
APEX	Malicious
Kaspersky	HEUR:Trojan.Win32.Strab.gen
BitDefender	Gen:Variant.Tedy.256405
MicroWorld-eScan	Gen:Variant.Tedy.256405
Avast	Win32:TrojanX-gen [Trj]
Ad-Aware	Gen:Variant.Tedy.256405
Emsisoft	Gen:Variant.Tedy.256405 (B)
McAfee-GW-Edition	Artemis!Trojan
Sophos	Mal/Generic-S
Microsoft	TrojanDownloader:Win32/SmallAgent.AW!MTB
GData	Gen:Variant.Tedy.256405
MAX	malware (ai score=87)
Malwarebytes	MachineLearning/Anomalous.96%
Rising	Trojan.Kryptik!8.8 (CLOUD)
MaxSecure	Trojan.Malware.300983.susgen
Fortinet	W32/PossibleThreat
AVG	Win32:TrojanX-gen [Trj]

setup.exe

Process Tree Toggle all

Network Toggle all

Suricata Toggle all

Suricata Alerts

Suricata TLS

Signatures Toggle All