popup
Summary | ZeroBOX
  1. Home
  2. Result
  3. Report
  4. Detail Analysis

cacert.exe

UPX Malicious Library AntiDebug PE64 PE File OS Processor Check PE32 AntiVM
  1. Resubmit sample
Category Machine Started Completed
FILE s1_win7_x6401 March 6, 2023, 9:40 a.m. March 6, 2023, 9:44 a.m.
Size 682.3KB
Type PE32 executable (GUI) Intel 80386, for MS Windows
MD5 47ca254d94b8ba124ba8a3fdb4a52653
SHA256 34da227493236d3129fabeebc637d0524123fb10b13a820d811041364fe0a59e
CRC32 9685A648
ssdeep 12288:vRZ+IoG/n9IQxW3OBsevLYTHDbv5DgsI/kXZb8GngkN/n:n2G/nvxW3Wq6al8GZn
PDB Path D:\Projects\WinRAR\sfx\build\sfxrar32\Release\sfxrar.pdb
Yara
  • OS_Processor_Check_Zero - OS Processor Check
  • UPX_Zero - UPX packed file
  • IsPE32 - (no description)
  • PE_Header_Zero - PE File Signature
  • Malicious_Library_Zero - Malicious_Library

Name Response Post-Analysis Lookup
No hosts contacted.
IP Address Status Action
39.107.70.26 Active Moloch

Suricata Alerts

Flow SID Signature Category
TCP 192.168.56.101:49166 -> 39.107.70.26:8888 2033713 ET MALWARE Cobalt Strike Beacon Observed Targeted Malicious Activity was Detected
TCP 192.168.56.101:49168 -> 39.107.70.26:8888 2033713 ET MALWARE Cobalt Strike Beacon Observed Targeted Malicious Activity was Detected

Suricata TLS

No Suricata TLS

Time & API Arguments Status Return Repeated

GetComputerNameA

 computer_name: TEST22-PC
1 1 0
Time & API Arguments Status Return Repeated

IsDebuggerPresent

 0 0
pdb_path D:\Projects\WinRAR\sfx\build\sfxrar32\Release\sfxrar.pdb
section .didat
resource name PNG
Time & API Arguments Status Return Repeated

NtProtectVirtualMemory

 process_identifier: 2568
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x72d62000
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2648
region_size: 319488
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x0000000000710000
allocation_type: 12288 (MEM_COMMIT|MEM_RESERVE)
process_handle: 0xffffffffffffffff
1 0 0

NtProtectVirtualMemory

 process_identifier: 2692
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x741f1000
process_handle: 0xffffffff
1 0 0

NtProtectVirtualMemory

 process_identifier: 2692
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x764b1000
process_handle: 0xffffffff
1 0 0

NtProtectVirtualMemory

 process_identifier: 2692
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x737e1000
process_handle: 0xffffffff
1 0 0

NtProtectVirtualMemory

 process_identifier: 2692
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x74180000
process_handle: 0xffffffff
1 0 0

NtProtectVirtualMemory

 process_identifier: 2692
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x73bc1000
process_handle: 0xffffffff
1 0 0

NtProtectVirtualMemory

 process_identifier: 2692
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x73751000
process_handle: 0xffffffff
1 0 0

NtProtectVirtualMemory

 process_identifier: 2692
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x73504000
process_handle: 0xffffffff
1 0 0

NtProtectVirtualMemory

 process_identifier: 2692
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x73bc2000
process_handle: 0xffffffff
1 0 0

NtProtectVirtualMemory

 process_identifier: 2692
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x74151000
process_handle: 0xffffffff
1 0 0

NtProtectVirtualMemory

 process_identifier: 2692
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x73271000
process_handle: 0xffffffff
1 0 0

NtProtectVirtualMemory

 process_identifier: 2692
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x73fa1000
process_handle: 0xffffffff
1 0 0

NtProtectVirtualMemory

 process_identifier: 2692
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x75941000
process_handle: 0xffffffff
1 0 0

NtProtectVirtualMemory

 process_identifier: 2692
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x73951000
process_handle: 0xffffffff
1 0 0

NtProtectVirtualMemory

 process_identifier: 2692
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x72d51000
process_handle: 0xffffffff
1 0 0

NtProtectVirtualMemory

 process_identifier: 2692
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x72d31000
process_handle: 0xffffffff
1 0 0

NtProtectVirtualMemory

 process_identifier: 2692
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x72cf1000
process_handle: 0xffffffff
1 0 0

NtProtectVirtualMemory

 process_identifier: 2692
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x72c51000
process_handle: 0xffffffff
1 0 0
description cacert.exe tried to sleep 171 seconds, actually delayed analysis time by 171 seconds
name PNG language LANG_CHINESE filetype PNG image data, 186 x 604, 8-bit/color RGB, non-interlaced sublanguage SUBLANG_CHINESE_SIMPLIFIED offset 0x0006406c size 0x000015a9
name PNG language LANG_CHINESE filetype PNG image data, 186 x 604, 8-bit/color RGB, non-interlaced sublanguage SUBLANG_CHINESE_SIMPLIFIED offset 0x0006406c size 0x000015a9
name RT_DIALOG language LANG_CHINESE filetype data sublanguage SUBLANG_CHINESE_SIMPLIFIED offset 0x000a7d48 size 0x000001e6
name RT_DIALOG language LANG_CHINESE filetype data sublanguage SUBLANG_CHINESE_SIMPLIFIED offset 0x000a7d48 size 0x000001e6
name RT_DIALOG language LANG_CHINESE filetype data sublanguage SUBLANG_CHINESE_SIMPLIFIED offset 0x000a7d48 size 0x000001e6
name RT_DIALOG language LANG_CHINESE filetype data sublanguage SUBLANG_CHINESE_SIMPLIFIED offset 0x000a7d48 size 0x000001e6
name RT_DIALOG language LANG_CHINESE filetype data sublanguage SUBLANG_CHINESE_SIMPLIFIED offset 0x000a7d48 size 0x000001e6
name RT_DIALOG language LANG_CHINESE filetype data sublanguage SUBLANG_CHINESE_SIMPLIFIED offset 0x000a7d48 size 0x000001e6
name RT_STRING language LANG_CHINESE filetype data sublanguage SUBLANG_CHINESE_SIMPLIFIED offset 0x000a8660 size 0x00000078
name RT_STRING language LANG_CHINESE filetype data sublanguage SUBLANG_CHINESE_SIMPLIFIED offset 0x000a8660 size 0x00000078
name RT_STRING language LANG_CHINESE filetype data sublanguage SUBLANG_CHINESE_SIMPLIFIED offset 0x000a8660 size 0x00000078
name RT_STRING language LANG_CHINESE filetype data sublanguage SUBLANG_CHINESE_SIMPLIFIED offset 0x000a8660 size 0x00000078
name RT_STRING language LANG_CHINESE filetype data sublanguage SUBLANG_CHINESE_SIMPLIFIED offset 0x000a8660 size 0x00000078
name RT_STRING language LANG_CHINESE filetype data sublanguage SUBLANG_CHINESE_SIMPLIFIED offset 0x000a8660 size 0x00000078
name RT_STRING language LANG_CHINESE filetype data sublanguage SUBLANG_CHINESE_SIMPLIFIED offset 0x000a8660 size 0x00000078
name RT_STRING language LANG_CHINESE filetype data sublanguage SUBLANG_CHINESE_SIMPLIFIED offset 0x000a8660 size 0x00000078
name RT_STRING language LANG_CHINESE filetype data sublanguage SUBLANG_CHINESE_SIMPLIFIED offset 0x000a8660 size 0x00000078
name RT_STRING language LANG_CHINESE filetype data sublanguage SUBLANG_CHINESE_SIMPLIFIED offset 0x000a8660 size 0x00000078
name RT_MANIFEST language LANG_CHINESE filetype XML 1.0 document, ASCII text, with CRLF line terminators sublanguage SUBLANG_CHINESE_SIMPLIFIED offset 0x000a86ec size 0x00000753
file C:\Windows\Temp\cacert.exe
file C:\Windows\Temp\cacert.exe
file C:\Windows\Temp\cacert.der
Time & API Arguments Status Return Repeated

NtProtectVirtualMemory

 process_identifier: 2648
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
length: 266240
protection: 32 (PAGE_EXECUTE_READ)
base_address: 0x0000000000570000
process_handle: 0xffffffffffffffff
1 0 0
description (no description) rule DebuggerCheck__GlobalFlags
description (no description) rule DebuggerCheck__QueryInfo
description (no description) rule DebuggerHiding__Thread
description (no description) rule DebuggerHiding__Active
description (no description) rule ThreadControl__Context
description (no description) rule SEH__vectored
description Checks if being debugged rule anti_dbg
description Bypass DEP rule disable_dep
host 39.107.70.26
Process injection Process 2568 resumed a thread in remote process 2692
Time & API Arguments Status Return Repeated

NtResumeThread

 thread_handle: 0x000002ac
suspend_count: 1
process_identifier: 2692
1 0 0
Lionic Trojan.Win32.Makop.trQA
Elastic malicious (high confidence)
MicroWorld-eScan Trojan.GenericKD.65676311
CAT-QuickHeal Trojan.CobaltStr.S17675256
McAfee Artemis!47CA254D94B8
Malwarebytes Malware.AI.855762316
Sangfor Backdoor.Win64.Cobaltstrike.V5u2
K7AntiVirus Trojan ( 0058fadf1 )
Alibaba Trojan:Win32/CozyDuke.1012
K7GW Trojan ( 0058fadf1 )
Cybereason malicious.d94b8b
Arcabit Trojan.Generic.D3EA2417
Cyren W64/Cobalt.A.gen!Eldorado
Symantec Backdoor.Cobalt!gen1
ESET-NOD32 a variant of Win64/CobaltStrike.Artifact.A
Cynet Malicious (score: 100)
APEX Malicious
Paloalto generic.ml
Kaspersky UDS:Trojan.Win64.CobaltStrike.gen
BitDefender Trojan.GenericKD.65676311
NANO-Antivirus Trojan.Win64.CobaltStrike.juzlgq
Avast Win64:HacktoolX-gen [Trj]
Tencent Win64.Trojan.Cobaltstrike.Cdhl
Sophos Generic ML PUA (PUA)
DrWeb BackDoor.CobaltStrike.86
VIPRE Trojan.GenericKD.65676311
TrendMicro Backdoor.Win64.COBEACON.SMA
McAfee-GW-Edition BehavesLike.Win32.Ctsinf.jh
FireEye Generic.mg.47ca254d94b8ba12
Emsisoft Trojan.GenericKD.65676311 (B)
SentinelOne Static AI - Malicious SFX
Avira HEUR/AGEN.1202022
Antiy-AVL HackTool[VirTool]/Win64.Atosev
Gridinsoft Trojan.Win32.CobaltStrike.bot
Xcitium Malware@#399xqwn4s5yi4
Microsoft Trojan:Win64/CobaltStrike.MBK!MTB
ZoneAlarm HEUR:Trojan.Win64.CobaltStrike.gen
GData Trojan.GenericKD.65676311
Google Detected
AhnLab-V3 Trojan/Win.CobaltStrike.C5388870
ALYac Trojan.GenericKD.65676311
MAX malware (ai score=85)
VBA32 Trojan.Win64.CobaltStrike
TrendMicro-HouseCall Backdoor.Win64.COBEACON.SMA
Rising Backdoor.CobaltStrike/x64!1.D04A (CLASSIC)
Yandex Trojan.GenAsa!ZICJWVi3Ujg
Ikarus Trojan.Win64.Cobaltstrike
MaxSecure Trojan.Malware.300983.susgen
Fortinet W64/Agent.CY!tr
AVG Win64:HacktoolX-gen [Trj]