popup
Summary | ZeroBOX
  1. Home
  2. Result
  3. Report
  4. Detail Analysis

NoNameProc.exe

Malicious Library Antivirus UPX PE64 DLL OS Processor Check PE File
  1. Resubmit sample
Category Machine Started Completed
FILE s1_win7_x6401 Jan. 22, 2023, 3:25 p.m. Jan. 22, 2023, 3:45 p.m.
Size 5.7MB
Type PE32+ executable (GUI) x86-64, for MS Windows
MD5 4ea2c030393e9e918bae4c1989c1e05f
SHA256 671e6d007aed4164ac23fbd2cfa309a0664a989f995b6c906bca9631cfd3767a
CRC32 297FE124
ssdeep 98304:5OoORURe3FhiW1J3qo1FOKSBbiWz1umNk7P82hBzw:5O3RUY3WWP7jO1BtYmNk7v
PDB Path J:\Crypts\Kover (vouch)\Project04.fix\NameProc.pdb
Yara
  • OS_Processor_Check_Zero - OS Processor Check
  • Win32_Trojan_Gen_2_0904B0_Zero - Win32 Trojan Gen
  • PE_Header_Zero - PE File Signature
  • Malicious_Library_Zero - Malicious_Library
  • IsPE64 - (no description)
  • UPX_Zero - UPX packed file

Name Response Post-Analysis Lookup
No hosts contacted.
IP Address Status Action
No hosts contacted.

Suricata Alerts

No Suricata Alerts

Suricata TLS

No Suricata TLS

Time & API Arguments Status Return Repeated

WriteConsoleW

 buffer: The system cannot find the file specified.
console_handle: 0x0000000000000007
1 1 0

WriteConsoleW

 buffer: netutils.dll
console_handle: 0x0000000000000007
1 1 0

WriteConsoleW

 buffer: 1 file(s) copied.
console_handle: 0x0000000000000007
1 1 0

WriteConsoleW

 buffer: '"C:\Windows \System32\SystemSettingsAdminFlows.exe"' is not recognized as an internal or external command, operable program or batch file.
console_handle: 0x000000000000000b
1 1 0

WriteConsoleW

 buffer: 'logs.bat' is not recognized as an internal or external command, operable program or batch file.
console_handle: 0x000000000000000b
1 1 0
pdb_path J:\Crypts\Kover (vouch)\Project04.fix\NameProc.pdb
section _RDATA
resource name RES
file C:\Users\test22\AppData\Local\Temp\netutils.dll
file C:\Users\test22\AppData\Local\Temp\log.bat
file C:\Users\test22\AppData\Local\Temp\logs.bat
FireEye Generic.mg.4ea2c030393e9e91
Cynet Malicious (score: 100)
APEX Malicious
Trapmine suspicious.low.ml.score
Acronis suspicious
section {u'size_of_data': u'0x00451800', u'virtual_address': u'0x0015e000', u'entropy': 7.972557294995117, u'name': u'.rsrc', u'virtual_size': u'0x00451690'} entropy 7.972557295 description A section with a high entropy has been found
entropy 0.761757105943 description Overall entropy of this PE file is high
Time & API Arguments Status Return Repeated

RegSetValueExA

 key_handle: 0x000000000000004c
regkey_r:
reg_type: 3 (REG_BINARY)
value: MZÿÿ¸@€º´ Í!¸LÍ!This program cannot be run in DOS mode. $PEd†°´5êð. 0Ä @  `…@@ „ H.text@à Ä `.rsrc„Æ@@HèÈB°Âú0Õ+(—e+A~ ( <jX( ( ( jXjX( ( &( jXjX ( ( j @ `jX 8pjX ( ( ( jXjX( ( ( jXjX( ( &( jXjX( ( ( jXjX( ( ( jX jX( ( ( jX$jX( (   8•( ( jX ZjX( ( jX( ( o 9U(  jX ZjX( ( X ( jX YZjX( (  (  jX( 8 X  ?bÿÿÿÝ&Ý*A ÀÍ 0A+(È*G/( ( o (+~%:&~þ s %€(+(+o  ( @O(%,o Ži 8š( œXŽi?ßÿÿÿ8J(%,o   Ži  8   š( œ X   Ži?ßÿÿÿ(( Ži( @( & Ži( ( &*0a+(„ vg(  ( @K(%,o Ži 8 š( œX Ži?áÿÿÿ8J(%,o Ži 8š( œXŽi?ßÿÿÿ( o (+~%:&~þ s %€(+(+o Ý &~ Ý~ ( 9G((Ži(  @ ( &Ži(    ( &*·Fý J+(x('I((*0t+(—36j PŽiYjnjXZ 8APPŽij]iPPŽij]i‘Žij]i‘aPjXPŽij]i‘Y X ]ҜjX >¸ÿÿÿPŽiY(+P*07+(ÅÖXL( (+( ( o (! ((" *^+(³rTV(Ÿs€*N+(gK[(Ÿ(# *z+(tÀ8(o$ (% ( *¶+(I[I`(& ((' o( o$ (% o *0Û+(ó+d~ ( <jX( ( ( jXjX( ( &( jXjX ( ( j @ `jX 8pjX ( ( ( jXjX( ( ( jXjX( ( &( jXjX( ( ( jXjX( ( ( jX jX( ( ( jX$jX( (   8•( ( jX ZjX( ( jX( ( o 9U(  jX ZjX( ( X ( jX YZjX( (  (  jX( 8 X  ?bÿÿÿÝ &(s) z*A ÀÍ 0»+(†(ZCT %Œ¢%MŒ¢%MŒ¢%Œ¢%KŒ¢ ( o (+~%:&~þs %€(+(+o (( Ð(* (+ o, ¥9*š¥T*N+(Xí~^(Ÿ(# *^+(€mRR(Ÿs€*N+(h¿Rj(Ÿ(# *z+(Ý=Jc(o$ (% ( *0#+(ÆÆfZ( ~o- ~¢*~+(ûkL~š%: &(*‚+(CíX~š%: & (*‚+(L¦2n~š%: & (*‚+(ó>V~š%: &&(*‚+(£J#?~š%: &=(*‚+(¦@"0~š%: &N(*‚+(ڃ2P~š%: &\(*‚+(5F[m~š%: &{(*Ž+(:L~š%:& ‘ (*–+(A==Z~ š%:& š (*0d+(&*m(Ÿ € ¦%Ð(. € 8~~‘a ªaҜX ~Žiþ:Öÿÿÿ*0j +(À‘Lb~  Xo/ o0  89š ~  o1 Xo2 t. (3 t o4 X Ži?¾ÿÿÿ*N+(ÓZ^Z(Ÿ(# *š+(ú5-4(ŸÐ (* o5 o6 € *0w€#Ð (* o5 € @%Ð:(. €/€.€!€2€ s# €"€ s# € €€€€~ €~ €$€*€€€%s7 €€+j€0€€(j€€1€)€,€~ €€s8 €'€€€€€€&~ € (9 %Ð;(. o( €-(: Ý&Ý*e p *0 W 
regkey: HKEY_CURRENT_USER\Software\NameProc\(Default)
1 0 0
Time & API Arguments Status Return Repeated

RegSetValueExA

 key_handle: 0x000000000000004c
regkey_r:
reg_type: 3 (REG_BINARY)
value: MZÿÿ¸@€º´ Í!¸LÍ!This program cannot be run in DOS mode. $PEd†°´5êð. 0Ä @  `…@@ „ H.text@à Ä `.rsrc„Æ@@HèÈB°Âú0Õ+(—e+A~ ( <jX( ( ( jXjX( ( &( jXjX ( ( j @ `jX 8pjX ( ( ( jXjX( ( ( jXjX( ( &( jXjX( ( ( jXjX( ( ( jX jX( ( ( jX$jX( (   8•( ( jX ZjX( ( jX( ( o 9U(  jX ZjX( ( X ( jX YZjX( (  (  jX( 8 X  ?bÿÿÿÝ&Ý*A ÀÍ 0A+(È*G/( ( o (+~%:&~þ s %€(+(+o  ( @O(%,o Ži 8š( œXŽi?ßÿÿÿ8J(%,o   Ži  8   š( œ X   Ži?ßÿÿÿ(( Ži( @( & Ži( ( &*0a+(„ vg(  ( @K(%,o Ži 8 š( œX Ži?áÿÿÿ8J(%,o Ži 8š( œXŽi?ßÿÿÿ( o (+~%:&~þ s %€(+(+o Ý &~ Ý~ ( 9G((Ži(  @ ( &Ži(    ( &*·Fý J+(x('I((*0t+(—36j PŽiYjnjXZ 8APPŽij]iPPŽij]i‘Žij]i‘aPjXPŽij]i‘Y X ]ҜjX >¸ÿÿÿPŽiY(+P*07+(ÅÖXL( (+( ( o (! ((" *^+(³rTV(Ÿs€*N+(gK[(Ÿ(# *z+(tÀ8(o$ (% ( *¶+(I[I`(& ((' o( o$ (% o *0Û+(ó+d~ ( <jX( ( ( jXjX( ( &( jXjX ( ( j @ `jX 8pjX ( ( ( jXjX( ( ( jXjX( ( &( jXjX( ( ( jXjX( ( ( jX jX( ( ( jX$jX( (   8•( ( jX ZjX( ( jX( ( o 9U(  jX ZjX( ( X ( jX YZjX( (  (  jX( 8 X  ?bÿÿÿÝ &(s) z*A ÀÍ 0»+(†(ZCT %Œ¢%MŒ¢%MŒ¢%Œ¢%KŒ¢ ( o (+~%:&~þs %€(+(+o (( Ð(* (+ o, ¥9*š¥T*N+(Xí~^(Ÿ(# *^+(€mRR(Ÿs€*N+(h¿Rj(Ÿ(# *z+(Ý=Jc(o$ (% ( *0#+(ÆÆfZ( ~o- ~¢*~+(ûkL~š%: &(*‚+(CíX~š%: & (*‚+(L¦2n~š%: & (*‚+(ó>V~š%: &&(*‚+(£J#?~š%: &=(*‚+(¦@"0~š%: &N(*‚+(ڃ2P~š%: &\(*‚+(5F[m~š%: &{(*Ž+(:L~š%:& ‘ (*–+(A==Z~ š%:& š (*0d+(&*m(Ÿ € ¦%Ð(. € 8~~‘a ªaҜX ~Žiþ:Öÿÿÿ*0j +(À‘Lb~  Xo/ o0  89š ~  o1 Xo2 t. (3 t o4 X Ži?¾ÿÿÿ*N+(ÓZ^Z(Ÿ(# *š+(ú5-4(ŸÐ (* o5 o6 € *0w€#Ð (* o5 € @%Ð:(. €/€.€!€2€ s# €"€ s# € €€€€~ €~ €$€*€€€%s7 €€+j€0€€(j€€1€)€,€~ €€s8 €'€€€€€€&~ € (9 %Ð;(. o( €-(: Ý&Ý*e p *0 W 
regkey: HKEY_CURRENT_USER\Software\NameProc\(Default)
1 0 0