popup
Summary | ZeroBOX
  1. Home
  2. Result
  3. Report
  4. Detail Analysis

rhh.exe

UPX Malicious Library ScreenShot AntiDebug PE File OS Processor Check PE32 AntiVM
  1. Resubmit sample
Category Machine Started Completed
FILE s1_win7_x6401 March 8, 2023, 11:02 a.m. March 8, 2023, 11:11 a.m.
Size 296.4KB
Type PE32 executable (console) Intel 80386, for MS Windows
MD5 6426a9c12a40aad907b96837a487e988
SHA256 95df8e09db02d2956bdd6a91041e3424020e9dc1e2775bac33b6c0af30fada43
CRC32 6BD904E0
ssdeep 6144:CcqAPUkzcupqh6R/sdawzeIDTOdKSmmwIZOaH6d6lDlRr:CcqAPUkzcuQh6udaxySmPIIHCx1
Yara
  • UPX_Zero - UPX packed file
  • Malicious_Library_Zero - Malicious_Library
  • OS_Processor_Check_Zero - OS Processor Check
  • Win_Backdoor_AsyncRAT_Zero - Win Backdoor AsyncRAT
  • IsPE32 - (no description)
  • PE_Header_Zero - PE File Signature

Name Response Post-Analysis Lookup
No hosts contacted.
IP Address Status Action
95.214.27.17 Active Moloch

Suricata Alerts

Flow SID Signature Category
TCP 192.168.56.101:49165 -> 95.214.27.17:443 2013028 ET POLICY curl User-Agent Outbound Attempted Information Leak
TCP 192.168.56.101:49167 -> 95.214.27.17:443 2013028 ET POLICY curl User-Agent Outbound Attempted Information Leak
TCP 192.168.56.101:49167 -> 95.214.27.17:443 2034567 ET HUNTING curl User-Agent to Dotted Quad Potentially Bad Traffic

Suricata TLS

No Suricata TLS

Time & API Arguments Status Return Repeated

GetComputerNameW

 computer_name: TEST22-PC
1 1 0
Time & API Arguments Status Return Repeated

GlobalMemoryStatusEx

 1 1 0
Time & API Arguments Status Return Repeated

NtProtectVirtualMemory

 process_identifier: 2544
stack_dep_bypass: 1
stack_pivoted: 0
heap_dep_bypass: 1
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x0018f000
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2544
region_size: 204800
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x00450000
allocation_type: 12288 (MEM_COMMIT|MEM_RESERVE)
process_handle: 0xffffffff
1 0 0

NtProtectVirtualMemory

 process_identifier: 2644
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
length: 102400
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x0051e000
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2644
region_size: 114688
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x003c0000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtProtectVirtualMemory

 process_identifier: 2644
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x75bf1000
process_handle: 0xffffffff
1 0 0

NtProtectVirtualMemory

 process_identifier: 2644
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x76281000
process_handle: 0xffffffff
1 0 0

NtProtectVirtualMemory

 process_identifier: 2644
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x75bc1000
process_handle: 0xffffffff
1 0 0

NtProtectVirtualMemory

 process_identifier: 2644
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x75d21000
process_handle: 0xffffffff
1 0 0

NtProtectVirtualMemory

 process_identifier: 2644
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x76f56000
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2644
region_size: 8192
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x00460000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtProtectVirtualMemory

 process_identifier: 2644
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x73be1000
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2644
region_size: 8192
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x004c0000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2848
region_size: 28672
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x00000000001f0000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffffffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2848
region_size: 1024000
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x000007ffffeb0000
allocation_type: 1052672 (MEM_COMMIT|MEM_TOP_DOWN)
process_handle: 0xffffffffffffffff
1 0 0
file C:\Users\test22\AppData\Local\Google\Chrome\User Data\Default\Web Data
file C:\Users\test22\AppData\Local\Google\Chrome\User Data\Default\Sync Extension Settings\pgiaagfkgcbnmiiolekcfmljdagdhlcm
file C:\Users\test22\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\kncchdigobghenbbaddojjnnaogfppfj
file C:\Users\test22\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\bocpokimicclpaiekenaeelehdjllofo
file C:\Users\test22\AppData\Local\Google\Chrome\User Data\Default\Sync Extension Settings\cjmkndjhnagcfbpiemnkdpomccnjblmj
file C:\Users\test22\AppData\Local\Google\Chrome\User Data\Default\Sync Extension Settings\hgmoaheomcjnaheggkfafnjilfcefbmo
file C:\Users\test22\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\agechnindjilpccclelhlbjphbgnobpf
file C:\Users\test22\AppData\Local\Google\Chrome\User Data\Default\Sync Extension Settings\infeboajgfhgbjpjbeppbkgnabfdkdaf
file C:\Users\test22\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\dmdimapfghaakeibppbfeokhgoikeoci
file C:\Users\test22\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fcbnlmiempnignmeapdbdnobahgelphj
file C:\Users\test22\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nphplpgoakhhjchkkhmiggakijnkhfnd
file C:\Users\test22\AppData\Local\Google\Chrome\User Data\Default\Sync Extension Settings\hpglfhgfnhbgpjdenjgmdgoeiappafln
file C:\Users\test22\AppData\Local\Google\Chrome\User Data\Default\Sync Extension Settings\dmdimapfghaakeibppbfeokhgoikeoci
file C:\Users\test22\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\aeachknmefphepccionboohckonoeemg
file C:\Users\test22\AppData\Local\Google\Chrome\User Data\Default\Sync Extension Settings\hnhobjmcibchnmglfbldbfabcgaknlkj
file C:\Users\test22\AppData\Local\Google\Chrome\User Data\Default\Sync Extension Settings\klnaejjgbibmhlephnhpmaofohgkpgkd
file C:\Users\test22\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\hgmoaheomcjnaheggkfafnjilfcefbmo
file C:\Users\test22\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\mgffkfbidihjpoaomajlbgchddlicgpn
file C:\Users\test22\AppData\Local\Google\Chrome\User Data\Default\Login Data
file C:\Users\test22\AppData\Local\Google\Chrome\User Data\Default\Sync Extension Settings\hnfanknocfeofbddgcijnmhnfnkdnaad
file C:\Users\test22\AppData\Local\Google\Chrome\User Data\Default\Sync Extension Settings\cjelfplplebdjjenllpjcblmjkfcffne
file C:\Users\test22\AppData\Local\Google\Chrome\User Data\Default\Sync Extension Settings\kncchdigobghenbbaddojjnnaogfppfj
file C:\Users\test22\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\egjidjbpglichdcondbcbdnbeeppgdph
file C:\Users\test22\AppData\Local\Google\Chrome\User Data\Default\Sync Extension Settings\fihkakfobkmkjojpchpfgcmhfjnmnfpi
file C:\Users\test22\AppData\Local\Google\Chrome\User Data\Default\Sync Extension Settings\cihmoadaighcejopammfbmddcmdekcje
file C:\Users\test22\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\afbcbjpbpfadlkmhmclhkeeodmamcflc
file C:\Users\test22\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\bofddndhbegljegmpmnlbhcejofmjgbn
file C:\Users\test22\AppData\Local\Google\Chrome\User Data\Default\Sync Extension Settings\dmkamcknogkgcdfhhbddcghachkejeap
file C:\Users\test22\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cihmoadaighcejopammfbmddcmdekcje
file C:\Users\test22\AppData\Local\Google\Chrome\User Data\Default\Sync Extension Settings\bhhhlbepdkbapadjdnnojkbgioiodbic
file C:\Users\test22\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\kpfopkelmapcoipemfendmdcghnegimn
file C:\Users\test22\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\hmeobnfnfcmdkdcmlblgagmfpfboieaf
file C:\Users\test22\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\bfnaelmomeimhlpmgjnjophhpkkoljpa
file C:\Users\test22\AppData\Local\Google\Chrome\User Data\Default\Sync Extension Settings\afbcbjpbpfadlkmhmclhkeeodmamcflc
file C:\Users\test22\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\pgiaagfkgcbnmiiolekcfmljdagdhlcm
file C:\Users\test22\AppData\Local\Google\Chrome\User Data\Default\Sync Extension Settings\jnkelfanjkeadonecabehalmbgpfodjm
file C:\Users\test22\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\aholpfdialjgjfhomihkjbmgjidlcdno
file C:\Users\test22\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fhilaheimglignddkjgofkcbgekhenbh
file C:\Users\test22\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ijmpgkjfkbfhoebgogflfebnmejmfbml
file C:\Users\test22\AppData\Local\Google\Chrome\User Data\Default\Sync Extension Settings\cnmamaachppnkjgnildpdmkaakejnhae
file C:\Users\test22\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fhmfendgdocmcbmfikdcogofphimnkno
file C:\Users\test22\AppData\Local\Google\Chrome\User Data\Default\Sync Extension Settings\nhnkbkgjikgcigadomkphalanndcapjk
file C:\Users\test22\AppData\Local\Google\Chrome\User Data\Default\Sync Extension Settings\bofddndhbegljegmpmnlbhcejofmjgbn
file C:\Users\test22\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\blnieiiffboillknjnepogjhkgnoapac
file C:\Users\test22\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\mcohilncbfahbmgdjkbpemcciiolgcge
file C:\Users\test22\AppData\Local\Google\Chrome\User Data\Default\Sync Extension Settings\fhilaheimglignddkjgofkcbgekhenbh
file C:\Users\test22\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cnmamaachppnkjgnildpdmkaakejnhae
file C:\Users\test22\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fhbohimaelbohpjbbldcngcnapndodjp
file C:\Users\test22\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\bhhhlbepdkbapadjdnnojkbgioiodbic
file C:\Users\test22\AppData\Local\Google\Chrome\User Data\Default\Sync Extension Settings\jiidiaalihmmhddjgbnbgdfflelocpak
section {u'size_of_data': u'0x0002e000', u'virtual_address': u'0x0001b000', u'entropy': 7.256256480205571, u'name': u'.data', u'virtual_size': u'0x0002eadc'} entropy 7.25625648021 description A section with a high entropy has been found
entropy 0.644483362522 description Overall entropy of this PE file is high
description Take ScreenShot rule ScreenShot
description (no description) rule DebuggerCheck__GlobalFlags
description (no description) rule DebuggerCheck__QueryInfo
description (no description) rule DebuggerHiding__Thread
description (no description) rule DebuggerHiding__Active
description (no description) rule ThreadControl__Context
description (no description) rule SEH__vectored
description Checks if being debugged rule anti_dbg
description Bypass DEP rule disable_dep
buffer Buffer with sha1: 9ad6061bfdbe0a3337bdde085b328901e0a3b1a6
host 95.214.27.17
Time & API Arguments Status Return Repeated

NtAllocateVirtualMemory

 process_identifier: 2644
region_size: 204800
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x00400000
allocation_type: 12288 (MEM_COMMIT|MEM_RESERVE)
process_handle: 0x0000002c
1 0 0
file C:\Users\test22\AppData\Local\Dogecoin\wallet.dat
file C:\Users\test22\AppData\Local\DashCore\wallets\wallet.dat
file C:\Users\test22\AppData\Roaming\Dogecoin\wallet.dat
file C:\Users\test22\AppData\Roaming\DashCore\wallets\wallet.dat
file C:\Users\test22\AppData\Roaming\Electrum\config
file C:\Users\test22\AppData\Local\Electrum\config
file C:\Users\test22\AppData\Local\Litecoin\wallets
file C:\Users\test22\AppData\Roaming\Litecoin\wallets
file C:\Users\test22\AppData\Local\bytecoin\bytecoin-gui.config
file C:\Users\test22\AppData\Roaming\bytecoin\bytecoin-gui.config
file C:\Users\test22\AppData\Roaming\GHISLER\wcx_ftp.ini
file C:\Users\test22\AppData\Roaming\.purple\accounts.xml
Time & API Arguments Status Return Repeated

WriteProcessMemory

 buffer: @
base_address: 0xfffde008
process_identifier: 2644
process_handle: 0x0000002c
1 1 0
Process injection Process 2544 called NtSetContextThread to modify thread in remote process 2644
Time & API Arguments Status Return Repeated

NtSetContextThread

 registers.eip: 1995571652
registers.esp: 3734272
registers.edi: 0
registers.eax: 4215111
registers.ebp: 0
registers.edx: 0
registers.ebx: -139264
registers.esi: 0
registers.ecx: 0
thread_handle: 0x00000020
process_identifier: 2644
1 0 0
file C:\Users\test22\AppData\Local\Exodus\exodus.wallet
file C:\Users\test22\AppData\Roaming\Exodus\exodus.wallet
Process injection Process 2544 resumed a thread in remote process 2644
Time & API Arguments Status Return Repeated

NtResumeThread

 thread_handle: 0x00000020
suspend_count: 1
process_identifier: 2644
1 0 0
Time & API Arguments Status Return Repeated

CreateProcessInternalW

 thread_identifier: 2648
thread_handle: 0x00000020
process_identifier: 2644
current_directory:
filepath: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
track: 1
command_line:
filepath_r: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
stack_pivoted: 0
creation_flags: 4 (CREATE_SUSPENDED)
inherit_handles: 0
process_handle: 0x0000002c
1 1 0

NtGetContextThread

 thread_handle: 0x00000020
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2644
region_size: 204800
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x00400000
allocation_type: 12288 (MEM_COMMIT|MEM_RESERVE)
process_handle: 0x0000002c
1 0 0

WriteProcessMemory

 buffer:
base_address: 0x00400000
process_identifier: 2644
process_handle: 0x0000002c
1 1 0

WriteProcessMemory

 buffer: @
base_address: 0xfffde008
process_identifier: 2644
process_handle: 0x0000002c
1 1 0

NtSetContextThread

 registers.eip: 1995571652
registers.esp: 3734272
registers.edi: 0
registers.eax: 4215111
registers.ebp: 0
registers.edx: 0
registers.ebx: -139264
registers.esi: 0
registers.ecx: 0
thread_handle: 0x00000020
process_identifier: 2644
1 0 0

NtResumeThread

 thread_handle: 0x00000020
suspend_count: 1
process_identifier: 2644
1 0 0

CreateProcessInternalW

 thread_identifier: 2852
thread_handle: 0x00000178
process_identifier: 2848
current_directory:
filepath: C:\Windows\System32\dllhost.exe
track: 1
command_line:
filepath_r: C:\Windows\system32\dllhost.exe
stack_pivoted: 0
creation_flags: 4 (CREATE_SUSPENDED)
inherit_handles: 0
process_handle: 0x0000017c
1 1 0
Lionic Trojan.Win32.Stealer.12!c
DrWeb Trojan.PWS.Siggen3.27265
MicroWorld-eScan Gen:Variant.Zusy.452341
FireEye Generic.mg.6426a9c12a40aad9
ALYac Gen:Variant.Mikey.145435
Malwarebytes Spyware.RedLineStealer
Sangfor Infostealer.Win32.Kryptik.Vjx6
Alibaba Trojan:Win32/Kryptik.4f99e654
CrowdStrike win/malicious_confidence_90% (W)
Arcabit Trojan.Mikey.D2381B
Symantec ML.Attribute.HighConfidence
Elastic malicious (high confidence)
ESET-NOD32 a variant of Win32/Kryptik.HSEV
Cynet Malicious (score: 99)
APEX Malicious
Paloalto generic.ml
Kaspersky HEUR:Trojan-Spy.Win32.Stealer.gen
BitDefender Gen:Variant.Zusy.452341
Avast Win32:CrypterX-gen [Trj]
Tencent Win32.Trojan.FalseSign.Fkjl
VIPRE Gen:Variant.Mikey.145435
TrendMicro TrojanSpy.Win32.RHADAMANTHYS.YXDCGZ
McAfee-GW-Edition Artemis!Trojan
Trapmine malicious.high.ml.score
Emsisoft Gen:Variant.Zusy.452341 (B)
Webroot W32.Trojan.Gen
Avira TR/AD.Nekark.lkowf
MAX malware (ai score=81)
Antiy-AVL Trojan/Win32.Kryptik
Gridinsoft Malware.Win32.Sabsik.cc
Microsoft Trojan:Win32/CryptInject!MSR
ViRobot Trojan.Win.Z.Mikey.303552
GData Gen:Variant.Zusy.452341
Google Detected
McAfee Artemis!6426A9C12A40
Cylance unsafe
TrendMicro-HouseCall TrojanSpy.Win32.RHADAMANTHYS.YXDCGZ
Rising Stealer.Agent!8.C2 (TFE:5:qjdrLr3qc8Q)
Ikarus Win32.Outbreak
Fortinet W32/Kryptik.HSEV!tr
AVG Win32:CrypterX-gen [Trj]