Summary | ZeroBOX

Category	Machine	Started	Completed
FILE	s1_win7_x6402	March 7, 2023, 6:05 p.m.	March 7, 2023, 6:07 p.m.

Size	354.6KB
Type	PE32 executable (console) Intel 80386, for MS Windows
MD5	`a0b3955d2406cf5b66628ea21bb1a41a`
SHA256	`ae6ee222c3ae8fb96f8513ff270ab95c2ad0738ba80c0d9bb140b42c5d0d5398`
CRC32	`98A5EE74`
ssdeep	`3072:N1wfJhEMhVSOyayzDt5qMROznoH6roQL46kZd1IKIDiWZVXyF:7YLLhVSNDt5qMAoH4oAkZduKQiz`
Yara	UPX_Zero - UPX packed file Malicious_Library_Zero - Malicious_Library OS_Processor_Check_Zero - OS Processor Check IsPE32 - (no description) PE_Header_Zero - PE File Signature

ChatGPT.scr "C:\Users\test22\AppData\Local\Temp\ChatGPT.scr"
3040
- AppLaunch.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"
  2192

Name	Response	Post-Analysis Lookup
No hosts contacted.

IP Address	Status	Action
142.132.186.212	Active	Moloch
164.124.101.2	Active	Moloch

Suricata Alerts

No Suricata Alerts

Suricata TLS

No Suricata TLS

Checks if process is being debugged by a debugger (2 events)

Time & API	Arguments	Status	Return	Repeated
IsDebuggerPresent March 7, 2023, 6:05 p.m.			0	0
IsDebuggerPresent March 7, 2023, 6:05 p.m.			0	0

Uses Windows APIs to generate a cryptographic key (3 events)

Time & API	Arguments	Status	Return
CryptExportKey March 7, 2023, 6:05 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x0052ca68 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey March 7, 2023, 6:05 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x0052ca68 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey March 7, 2023, 6:05 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x0052caa8 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1

Checks amount of memory in system, this can be used to detect virtual machines that have a low amount of memory available (1 event)

Time & API	Arguments	Status	Return	Repeated
GlobalMemoryStatusEx March 7, 2023, 6:05 p.m.		1	1	0

One or more potentially interesting buffers were extracted, these generally contain injected code, configuration data, etc.

Allocates read-write-execute memory (usually to unpack itself) (37 events)

Time & API	Arguments	Status
NtProtectVirtualMemory March 7, 2023, 6:05 p.m.	process_identifier: 3040 stack_dep_bypass: 1 stack_pivoted: 0 heap_dep_bypass: 1 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0018f000 process_handle: 0xffffffff	1
NtAllocateVirtualMemory March 7, 2023, 6:05 p.m.	process_identifier: 3040 region_size: 286720 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00370000 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0xffffffff	1
NtProtectVirtualMemory March 7, 2023, 6:05 p.m.	process_identifier: 2192 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x745a2000 process_handle: 0xffffffff	1
NtAllocateVirtualMemory March 7, 2023, 6:05 p.m.	process_identifier: 2192 region_size: 1376256 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00740000 allocation_type: 8192 (MEM_RESERVE) process_handle: 0xffffffff	1
NtAllocateVirtualMemory March 7, 2023, 6:05 p.m.	process_identifier: 2192 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00850000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtProtectVirtualMemory March 7, 2023, 6:05 p.m.	process_identifier: 2192 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x741f2000 process_handle: 0xffffffff	1
NtProtectVirtualMemory March 7, 2023, 6:05 p.m.	process_identifier: 2192 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x73b9b000 process_handle: 0xffffffff	1
NtProtectVirtualMemory March 7, 2023, 6:05 p.m.	process_identifier: 2192 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x73bb1000 process_handle: 0xffffffff	1
NtProtectVirtualMemory March 7, 2023, 6:05 p.m.	process_identifier: 2192 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x73bb2000 process_handle: 0xffffffff	1
NtAllocateVirtualMemory March 7, 2023, 6:05 p.m.	process_identifier: 2192 region_size: 393216 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x006d0000 allocation_type: 8192 (MEM_RESERVE) process_handle: 0xffffffff	1
NtAllocateVirtualMemory March 7, 2023, 6:05 p.m.	process_identifier: 2192 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x006f0000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory March 7, 2023, 6:05 p.m.	process_identifier: 2192 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00492000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory March 7, 2023, 6:05 p.m.	process_identifier: 2192 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x005c5000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory March 7, 2023, 6:05 p.m.	process_identifier: 2192 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x005cb000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory March 7, 2023, 6:05 p.m.	process_identifier: 2192 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x005c7000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory March 7, 2023, 6:05 p.m.	process_identifier: 2192 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x004ac000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtProtectVirtualMemory March 7, 2023, 6:05 p.m.	process_identifier: 2192 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x7452a000 process_handle: 0xffffffff	1
NtAllocateVirtualMemory March 7, 2023, 6:05 p.m.	process_identifier: 2192 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x008d0000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory March 7, 2023, 6:05 p.m.	process_identifier: 2192 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x005b6000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory March 7, 2023, 6:05 p.m.	process_identifier: 2192 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x005ba000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory March 7, 2023, 6:05 p.m.	process_identifier: 2192 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x005b7000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtProtectVirtualMemory March 7, 2023, 6:05 p.m.	process_identifier: 2192 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x6f451000 process_handle: 0xffffffff	1
NtAllocateVirtualMemory March 7, 2023, 6:05 p.m.	process_identifier: 2192 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0049a000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory March 7, 2023, 6:05 p.m.	process_identifier: 2192 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x005bb000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory March 7, 2023, 6:05 p.m.	process_identifier: 2192 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x004aa000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory March 7, 2023, 6:05 p.m.	process_identifier: 2192 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x005bc000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory March 7, 2023, 6:05 p.m.	process_identifier: 2192 region_size: 327680 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0xfff50000 allocation_type: 1056768 (MEM_RESERVE\|MEM_TOP_DOWN) process_handle: 0xffffffff	1
NtAllocateVirtualMemory March 7, 2023, 6:05 p.m.	process_identifier: 2192 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0xfff50000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory March 7, 2023, 6:05 p.m.	process_identifier: 2192 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0xfff50000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory March 7, 2023, 6:05 p.m.	process_identifier: 2192 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0xfff58000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory March 7, 2023, 6:05 p.m.	process_identifier: 2192 region_size: 65536 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0xfff40000 allocation_type: 1056768 (MEM_RESERVE\|MEM_TOP_DOWN) process_handle: 0xffffffff	1
NtAllocateVirtualMemory March 7, 2023, 6:05 p.m.	process_identifier: 2192 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0xfff40000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtProtectVirtualMemory March 7, 2023, 6:05 p.m.	process_identifier: 2192 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x74fc1000 process_handle: 0xffffffff	1
NtProtectVirtualMemory March 7, 2023, 6:05 p.m.	process_identifier: 2192 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x6f0e1000 process_handle: 0xffffffff	1
NtProtectVirtualMemory March 7, 2023, 6:05 p.m.	process_identifier: 2192 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x6f018000 process_handle: 0xffffffff	1
NtAllocateVirtualMemory March 7, 2023, 6:05 p.m.	process_identifier: 2192 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x005bd000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory March 7, 2023, 6:05 p.m.	process_identifier: 2192 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x005b8000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1

Yara rule detected in process memory (9 events)

description	(no description)	rule	DebuggerCheck__GlobalFlags
description	(no description)	rule	DebuggerCheck__QueryInfo
description	(no description)	rule	DebuggerHiding__Thread
description	(no description)	rule	DebuggerHiding__Active
description	(no description)	rule	ThreadControl__Context
description	(no description)	rule	SEH__vectored
description	Checks if being debugged	rule	anti_dbg
description	Bypass DEP	rule	disable_dep
description	RedLine stealer	rule	RedLine_Stealer_m_Zero

One or more of the buffers contains an embedded PE file (1 event)

buffer

Buffer with sha1: 613001fb99c5e95300294a2678fff6d543f77c1a

Communicates with host for which no DNS query was performed (1 event)

host

142.132.186.212

Allocates execute permission to another process indicative of possible code injection (1 event)

Time & API	Arguments	Status	Return	Repeated
NtAllocateVirtualMemory March 7, 2023, 6:05 p.m.	process_identifier: 2192 region_size: 286720 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00400000 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0x0000002c	1	0	0

Potential code injection by writing to the memory of another process (1 event)

Time & API	Arguments	Status	Return	Repeated
WriteProcessMemory March 7, 2023, 6:05 p.m.	buffer: @ base_address: 0xfffde008 process_identifier: 2192 process_handle: 0x0000002c	1	1	0

Used NtSetContextThread to modify a thread in a remote process indicative of process injection (2 events)

Time & API	Arguments	Status	Return	Repeated
Process injection	Process 3040 called NtSetContextThread to modify thread in remote process 2192
NtSetContextThread March 7, 2023, 6:05 p.m.	registers.eip: 2001207748 registers.esp: 1964644 registers.edi: 0 registers.eax: 4294686 registers.ebp: 0 registers.edx: 0 registers.ebx: -139264 registers.esi: 0 registers.ecx: 0 thread_handle: 0x00000020 process_identifier: 2192	1	0	0

Resumed a suspended thread in a remote process potentially indicative of process injection (2 events)

Time & API	Arguments	Status	Return	Repeated
Process injection	Process 3040 resumed a thread in remote process 2192
NtResumeThread March 7, 2023, 6:05 p.m.	thread_handle: 0x00000020 suspend_count: 1 process_identifier: 2192	1	0	0

Executed a process and injected code into it, probably while unpacking (10 events)

Time & API	Arguments	Status	Return
CreateProcessInternalW March 7, 2023, 6:05 p.m.	thread_identifier: 2196 thread_handle: 0x00000020 process_identifier: 2192 current_directory: filepath: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe track: 1 command_line: filepath_r: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe stack_pivoted: 0 creation_flags: 4 (CREATE_SUSPENDED) inherit_handles: 0 process_handle: 0x0000002c	1	1
NtGetContextThread March 7, 2023, 6:05 p.m.	thread_handle: 0x00000020	1	0
NtAllocateVirtualMemory March 7, 2023, 6:05 p.m.	process_identifier: 2192 region_size: 286720 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00400000 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0x0000002c	1	0
WriteProcessMemory March 7, 2023, 6:05 p.m.	buffer: base_address: 0x00400000 process_identifier: 2192 process_handle: 0x0000002c	1	1
WriteProcessMemory March 7, 2023, 6:05 p.m.	buffer: @ base_address: 0xfffde008 process_identifier: 2192 process_handle: 0x0000002c	1	1
NtSetContextThread March 7, 2023, 6:05 p.m.	registers.eip: 2001207748 registers.esp: 1964644 registers.edi: 0 registers.eax: 4294686 registers.ebp: 0 registers.edx: 0 registers.ebx: -139264 registers.esi: 0 registers.ecx: 0 thread_handle: 0x00000020 process_identifier: 2192	1	0
NtResumeThread March 7, 2023, 6:05 p.m.	thread_handle: 0x00000020 suspend_count: 1 process_identifier: 2192	1	0
NtResumeThread March 7, 2023, 6:05 p.m.	thread_handle: 0x00000144 suspend_count: 1 process_identifier: 2192	1	0
NtResumeThread March 7, 2023, 6:05 p.m.	thread_handle: 0x000001bc suspend_count: 1 process_identifier: 2192	1	0
NtResumeThread March 7, 2023, 6:05 p.m.	thread_handle: 0x000001f8 suspend_count: 1 process_identifier: 2192	1	0

Connects to IP addresses that are no longer responding to requests (legitimate services will remain up-and-running usually) (50 out of 67 events)

dead_host	192.168.56.102:49172
dead_host	192.168.56.102:49187
dead_host	192.168.56.102:49205
dead_host	192.168.56.102:49216
dead_host	192.168.56.102:49167
dead_host	192.168.56.102:49196
dead_host	192.168.56.102:49229
dead_host	192.168.56.102:49176
dead_host	192.168.56.102:49191
dead_host	192.168.56.102:49209
dead_host	192.168.56.102:49220
dead_host	192.168.56.102:49171
dead_host	192.168.56.102:49227
dead_host	192.168.56.102:49200
dead_host	192.168.56.102:49180
dead_host	192.168.56.102:49195
dead_host	192.168.56.102:49213
dead_host	192.168.56.102:49224
dead_host	192.168.56.102:49175
dead_host	192.168.56.102:49186
dead_host	192.168.56.102:49204
dead_host	192.168.56.102:49219
dead_host	192.168.56.102:49166
dead_host	192.168.56.102:49199
dead_host	192.168.56.102:49228
dead_host	192.168.56.102:49179
dead_host	192.168.56.102:49190
dead_host	192.168.56.102:49208
dead_host	192.168.56.102:49223
dead_host	192.168.56.102:49203
dead_host	192.168.56.102:49183
dead_host	192.168.56.102:49194
dead_host	192.168.56.102:49212
dead_host	142.132.186.212:8901
dead_host	192.168.56.102:49174
dead_host	192.168.56.102:49207
dead_host	192.168.56.102:49218
dead_host	192.168.56.102:49198
dead_host	192.168.56.102:49231
dead_host	192.168.56.102:49178
dead_host	192.168.56.102:49185
dead_host	192.168.56.102:49211
dead_host	192.168.56.102:49222
dead_host	192.168.56.102:49165
dead_host	192.168.56.102:49202
dead_host	192.168.56.102:49182
dead_host	192.168.56.102:49189
dead_host	192.168.56.102:49215
dead_host	192.168.56.102:49226
dead_host	192.168.56.102:49169

ChatGPT.scr

Process Tree Toggle all

Network Toggle all

Suricata Toggle all

Suricata Alerts

Suricata TLS

Signatures Toggle All