popup
Summary | ZeroBOX
  1. Home
  2. Result
  3. Report
  4. Detail Analysis

enes.exe

North Korea Generic Malware task schedule Antivirus UPX ScreenShot GIF Format AntiDebug PE32 PE File .NET EXE AntiVM
  1. Resubmit sample
Category Machine Started Completed
FILE s1_win7_x6403_us March 17, 2023, 5:30 p.m. March 17, 2023, 5:36 p.m.
Size 2.6MB
Type PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
MD5 843bab6d9df36499a5880621c9fd1cd8
SHA256 4f441a6bb7bfd54af0c0fcc7f53f6afad3a126835f56e431f55ebde8a13a0965
CRC32 6590BB90
ssdeep 49152:WWsTEkwghTKv4jysGUqgCoOtt1JKtmqABg6ryUQtv:WFEkwghTKv4jysGUqgCxttsmqABRCtv
PDB Path C:\Users\REDLINE\AppData\Local\Temp\AjFEE.pdb
Yara
  • UPX_Zero - UPX packed file
  • Generic_Malware_Zero - Generic Malware
  • Is_DotNET_EXE - (no description)
  • Win_Backdoor_AsyncRAT_Zero - Win Backdoor AsyncRAT
  • IsPE32 - (no description)
  • PE_Header_Zero - PE File Signature
  • Antivirus - Contains references to security software
  • NorthKorea_Zero - Maybe it's North Korea File

Name Response Post-Analysis Lookup
No hosts contacted.
IP Address Status Action
88.248.18.120 Active Moloch

Suricata Alerts

No Suricata Alerts

Suricata TLS

No Suricata TLS

Time & API Arguments Status Return Repeated

GetComputerNameW

 computer_name: TEST22-PC
1 1 0
Time & API Arguments Status Return Repeated

IsDebuggerPresent

 0 0

IsDebuggerPresent

 0 0
registry HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\MachineGuid
pdb_path C:\Users\REDLINE\AppData\Local\Temp\AjFEE.pdb
Time & API Arguments Status Return Repeated

GlobalMemoryStatusEx

 1 1 0
Time & API Arguments Status Return Repeated

NtAllocateVirtualMemory

 process_identifier: 1680
region_size: 327680
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x00300000
allocation_type: 8192 (MEM_RESERVE)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 1680
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x00310000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtProtectVirtualMemory

 process_identifier: 1680
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x73f61000
process_handle: 0xffffffff
1 0 0

NtProtectVirtualMemory

 process_identifier: 1680
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x73f62000
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 1680
region_size: 655360
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x009b0000
allocation_type: 8192 (MEM_RESERVE)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 1680
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x00a10000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 1680
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x00472000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 1680
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x005a5000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 1680
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x005ab000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 1680
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x005a7000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 1680
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x0048c000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 1680
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x00af0000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 1680
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x0059a000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 1680
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x00597000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 1680
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x00596000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 1680
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x0047a000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 1680
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x00af1000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 1236
region_size: 65536
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x0000000006840000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffffffffffff
1 0 0
file C:\Users\test22\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\%startupname%.lnk
file C:\Users\test22\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\%startupname%.lnk
description Take ScreenShot rule ScreenShot
description PWS Memory rule Generic_PWS_Memory_Zero
description task schedule rule schtasks_Zero
description (no description) rule DebuggerCheck__GlobalFlags
description (no description) rule DebuggerCheck__QueryInfo
description (no description) rule DebuggerCheck__RemoteAPI
description (no description) rule DebuggerHiding__Thread
description (no description) rule DebuggerHiding__Active
description (no description) rule ThreadControl__Context
description (no description) rule SEH__vectored
description Checks if being debugged rule anti_dbg
description Bypass DEP rule disable_dep
buffer Buffer with sha1: 4cecf16c67f7eb7bd9d76ff58ad1447731f88ffc
buffer Buffer with sha1: c02bbe2b97dd60f86ab743c949c61f4f48094ccb
host 88.248.18.120
Time & API Arguments Status Return Repeated

NtAllocateVirtualMemory

 process_identifier: 2176
region_size: 73728
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x00400000
allocation_type: 12288 (MEM_COMMIT|MEM_RESERVE)
process_handle: 0x00000394
1 0 0
file C:\Users\test22\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\%startupname%.lnk
Process injection Process 1680 manipulating memory of non-child process 2176
Time & API Arguments Status Return Repeated

NtAllocateVirtualMemory

 process_identifier: 2176
region_size: 73728
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x00400000
allocation_type: 12288 (MEM_COMMIT|MEM_RESERVE)
process_handle: 0x00000394
1 0 0
Process injection Process 1680 injected into non-child 2176
Time & API Arguments Status Return Repeated

WriteProcessMemory

 buffer: MZÿÿ¸@€º´ Í!¸LÍ!This program cannot be run in DOS mode. $PEL#·^à ² ÞÐ à@  @…ŒÐOà(   H.textä° ² `.rsrc( à ´@@.reloc ¾@B
base_address: 0x00400000
process_identifier: 2176
process_handle: 0x00000394
1 1 0

WriteProcessMemory

 buffer:  €8€P€h€€ àôä”ä“äô4VS_VERSION_INFO½ïþŠaJŠaJ?DVarFileInfo$Translation°TStringFileInfo0000004b0CommentsLCompanyNameMicrosoft CorporationPFileDescriptionMUI unattend action<FileVersion6.2.19041.906@InternalNameMuiUnattend.exe€.LegalCopyright© Microsoft Corporation. All rights reserved.*LegalTrademarksHOriginalFilenameMuiUnattend.exej%ProductNameMicrosoft® Windows® Operating System@ProductVersion6.2.19041.906DAssembly Version6.2.19041.906<assembly xmlns="urn:schemas-microsoft-com:asm.v1" manifestVersion="1.0"> <trustInfo xmlns="urn:schemas-microsoft-com:asm.v2"> <security> <requestedPrivileges> <requestedExecutionLevel level="asInvoker" uiAccess="false" /> </requestedPrivileges> </security> </trustInfo> <compatibility xmlns="urn:schemas-microsoft-com:compatibility.v1"> <application> <!-- Windows Vista --> <supportedOS Id="{e2011457-1546-43c5-a5fe-008deee3d3f0}"/> <!-- Windows 7 --> <supportedOS Id="{35138b9a-5d96-4fbd-8e2d-a2440225f93a}"/> <!-- Windows 8 --> <supportedOS Id="{4a2f28e3-53b9-4441-ba9c-d69d4a4a6e38}"/> <!-- Windows 8.1 --> <supportedOS Id="{1f676c76-80e1-4239-95bb-83d0f6d0da78}"/> <!-- Windows 10 --> <supportedOS Id="{8e0f7a12-bfb3-4fe8-b9a5-48fd50a15a9a}"/> </application> </compatibility> <asmv3:application xmlns:asmv3="urn:schemas-microsoft-com:asm.v3" > <asmv3:windowsSettings xmlns="http://schemas.microsoft.com/SMI/2005/WindowsSettings"> <dpiAware>true</dpiAware> </asmv3:windowsSettings> </asmv3:application> </assembly>PPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGX
base_address: 0x0040e000
process_identifier: 2176
process_handle: 0x00000394
1 1 0

WriteProcessMemory

 buffer: Ð à0
base_address: 0x00410000
process_identifier: 2176
process_handle: 0x00000394
1 1 0

WriteProcessMemory

 buffer: @
base_address: 0x7efde008
process_identifier: 2176
process_handle: 0x00000394
1 1 0
Process injection Process 1680 injected into non-child 2176
Time & API Arguments Status Return Repeated

WriteProcessMemory

 buffer: MZÿÿ¸@€º´ Í!¸LÍ!This program cannot be run in DOS mode. $PEL#·^à ² ÞÐ à@  @…ŒÐOà(   H.textä° ² `.rsrc( à ´@@.reloc ¾@B
base_address: 0x00400000
process_identifier: 2176
process_handle: 0x00000394
1 1 0
Process injection Process 1680 called NtSetContextThread to modify thread in remote process 2176
Time & API Arguments Status Return Repeated

NtSetContextThread

 registers.eip: 0
registers.esp: 0
registers.edi: 0
registers.eax: 4247774
registers.ebp: 0
registers.edx: 0
registers.ebx: 2130567168
registers.esi: 0
registers.ecx: 0
thread_handle: 0x00000398
process_identifier: 2176
1 0 0
Process injection Process 1680 resumed a thread in remote process 2176
Time & API Arguments Status Return Repeated

NtResumeThread

 thread_handle: 0x00000398
suspend_count: 1
process_identifier: 2176
1 0 0
dead_host 88.248.18.120:33918
Time & API Arguments Status Return Repeated

NtResumeThread

 thread_handle: 0x000000dc
suspend_count: 1
process_identifier: 1680
1 0 0

NtResumeThread

 thread_handle: 0x0000014c
suspend_count: 1
process_identifier: 1680
1 0 0

NtResumeThread

 thread_handle: 0x00000194
suspend_count: 1
process_identifier: 1680
1 0 0

CreateProcessInternalW

 thread_identifier: 2180
thread_handle: 0x00000398
process_identifier: 2176
current_directory:
filepath: C:\Users\test22\AppData\Local\Temp\enes.exe
track: 1
command_line:
filepath_r: C:\Users\test22\AppData\Local\Temp\enes.exe
stack_pivoted: 0
creation_flags: 134217732 (CREATE_NO_WINDOW|CREATE_SUSPENDED)
inherit_handles: 0
process_handle: 0x00000394
1 1 0

NtGetContextThread

 thread_handle: 0x00000398
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2176
region_size: 73728
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x00400000
allocation_type: 12288 (MEM_COMMIT|MEM_RESERVE)
process_handle: 0x00000394
1 0 0

WriteProcessMemory

 buffer: MZÿÿ¸@€º´ Í!¸LÍ!This program cannot be run in DOS mode. $PEL#·^à ² ÞÐ à@  @…ŒÐOà(   H.textä° ² `.rsrc( à ´@@.reloc ¾@B
base_address: 0x00400000
process_identifier: 2176
process_handle: 0x00000394
1 1 0

WriteProcessMemory

 buffer:
base_address: 0x00402000
process_identifier: 2176
process_handle: 0x00000394
1 1 0

WriteProcessMemory

 buffer:  €8€P€h€€ àôä”ä“äô4VS_VERSION_INFO½ïþŠaJŠaJ?DVarFileInfo$Translation°TStringFileInfo0000004b0CommentsLCompanyNameMicrosoft CorporationPFileDescriptionMUI unattend action<FileVersion6.2.19041.906@InternalNameMuiUnattend.exe€.LegalCopyright© Microsoft Corporation. All rights reserved.*LegalTrademarksHOriginalFilenameMuiUnattend.exej%ProductNameMicrosoft® Windows® Operating System@ProductVersion6.2.19041.906DAssembly Version6.2.19041.906<assembly xmlns="urn:schemas-microsoft-com:asm.v1" manifestVersion="1.0"> <trustInfo xmlns="urn:schemas-microsoft-com:asm.v2"> <security> <requestedPrivileges> <requestedExecutionLevel level="asInvoker" uiAccess="false" /> </requestedPrivileges> </security> </trustInfo> <compatibility xmlns="urn:schemas-microsoft-com:compatibility.v1"> <application> <!-- Windows Vista --> <supportedOS Id="{e2011457-1546-43c5-a5fe-008deee3d3f0}"/> <!-- Windows 7 --> <supportedOS Id="{35138b9a-5d96-4fbd-8e2d-a2440225f93a}"/> <!-- Windows 8 --> <supportedOS Id="{4a2f28e3-53b9-4441-ba9c-d69d4a4a6e38}"/> <!-- Windows 8.1 --> <supportedOS Id="{1f676c76-80e1-4239-95bb-83d0f6d0da78}"/> <!-- Windows 10 --> <supportedOS Id="{8e0f7a12-bfb3-4fe8-b9a5-48fd50a15a9a}"/> </application> </compatibility> <asmv3:application xmlns:asmv3="urn:schemas-microsoft-com:asm.v3" > <asmv3:windowsSettings xmlns="http://schemas.microsoft.com/SMI/2005/WindowsSettings"> <dpiAware>true</dpiAware> </asmv3:windowsSettings> </asmv3:application> </assembly>PPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGX
base_address: 0x0040e000
process_identifier: 2176
process_handle: 0x00000394
1 1 0

WriteProcessMemory

 buffer: Ð à0
base_address: 0x00410000
process_identifier: 2176
process_handle: 0x00000394
1 1 0

WriteProcessMemory

 buffer: @
base_address: 0x7efde008
process_identifier: 2176
process_handle: 0x00000394
1 1 0

NtSetContextThread

 registers.eip: 0
registers.esp: 0
registers.edi: 0
registers.eax: 4247774
registers.ebp: 0
registers.edx: 0
registers.ebx: 2130567168
registers.esi: 0
registers.ecx: 0
thread_handle: 0x00000398
process_identifier: 2176
1 0 0

NtResumeThread

 thread_handle: 0x00000398
suspend_count: 1
process_identifier: 2176
1 0 0
Bkav W32.AIDetectNet.01
Elastic malicious (high confidence)
MicroWorld-eScan IL:Trojan.MSILZilla.26093
FireEye IL:Trojan.MSILZilla.26093
McAfee GenericRXVN-CF!843BAB6D9DF3
VIPRE IL:Trojan.MSILZilla.26093
CrowdStrike win/malicious_confidence_100% (D)
Arcabit IL:Trojan.MSILZilla.D65ED
BitDefenderTheta Gen:NN.ZemsilF.36344.Mo0@aaevb0i
VirIT Trojan.Win32.MSIL_Heur.A
Symantec ML.Attribute.HighConfidence
ESET-NOD32 a variant of MSIL/TrojanDownloader.Agent.NEN
Cynet Malicious (score: 100)
APEX Malicious
Kaspersky HEUR:Trojan-Spy.MSIL.SnakeLogger.gen
BitDefender IL:Trojan.MSILZilla.26093
Avast Win32:RATX-gen [Trj]
Tencent Msil.Trojan-Downloader.Ader.Oqil
Emsisoft IL:Trojan.MSILZilla.26093 (B)
McAfee-GW-Edition GenericRXVN-CF!843BAB6D9DF3
Ikarus Trojan.MSIL.Krypt
Microsoft Trojan:MSIL/AveMaria.NECT!MTB
GData IL:Trojan.MSILZilla.26093
Google Detected
AhnLab-V3 Infostealer/Win.RequestPOST.C5337962
VBA32 OScope.Malware-Cryptor.MSIL.Agent
ALYac IL:Trojan.MSILZilla.26093
MAX malware (ai score=83)
Malwarebytes Malware.AI.4177324091
Rising Spyware.SnakeLogger!8.15FDD (TFE:dGZlOg0gU0ST/JFS3A)
Fortinet MSIL/Agent.MQA!tr
AVG Win32:RATX-gen [Trj]