popup
Summary | ZeroBOX
  1. Home
  2. Result
  3. Report
  4. Detail Analysis

lastdc.exe

North Korea Generic Malware Antivirus UPX Code injection ScreenShot GIF Format AntiDebug PE32 PE File .NET EXE AntiVM
  1. Resubmit sample
Category Machine Started Completed
FILE s1_win7_x6403_us March 17, 2023, 5:31 p.m. March 17, 2023, 6:06 p.m.
Size 2.6MB
Type PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
MD5 2d0cc7c5c9953f0b7c91b26533f93cbc
SHA256 79edd0ed1204d38ba8d6269eb025a5780067d2b4f11c6aee3318065ce6a14945
CRC32 3E606397
ssdeep 49152:oWsTEkwghTKv4jysGUqgCoOtt1JKeENicJWTtv:oFEkwghTKv4jysGUqgCxtttEwRtv
PDB Path C:\Users\REDLINE\AppData\Local\Temp\AjFEE.pdb
Yara
  • UPX_Zero - UPX packed file
  • Generic_Malware_Zero - Generic Malware
  • Is_DotNET_EXE - (no description)
  • Win_Backdoor_AsyncRAT_Zero - Win Backdoor AsyncRAT
  • IsPE32 - (no description)
  • PE_Header_Zero - PE File Signature
  • Antivirus - Contains references to security software
  • NorthKorea_Zero - Maybe it's North Korea File

Name Response Post-Analysis Lookup
No hosts contacted.
IP Address Status Action
164.124.101.2 Active Moloch
217.64.31.3 Active Moloch

Suricata Alerts

No Suricata Alerts

Suricata TLS

No Suricata TLS

Time & API Arguments Status Return Repeated

GetComputerNameW

 computer_name: TEST22-PC
1 1 0
Time & API Arguments Status Return Repeated

IsDebuggerPresent

 0 0

IsDebuggerPresent

 0 0
registry HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\MachineGuid
pdb_path C:\Users\REDLINE\AppData\Local\Temp\AjFEE.pdb
Time & API Arguments Status Return Repeated

GlobalMemoryStatusEx

 1 1 0
Time & API Arguments Status Return Repeated

NtAllocateVirtualMemory

 process_identifier: 296
region_size: 1703936
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x00ac0000
allocation_type: 8192 (MEM_RESERVE)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 296
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x00c20000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtProtectVirtualMemory

 process_identifier: 296
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x73f31000
process_handle: 0xffffffff
1 0 0

NtProtectVirtualMemory

 process_identifier: 296
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x73f32000
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 296
region_size: 917504
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x007b0000
allocation_type: 8192 (MEM_RESERVE)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 296
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x00850000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 296
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x00642000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 296
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x00675000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 296
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x0067b000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 296
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x00677000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 296
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x0065c000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 296
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x00a60000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 296
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x0066a000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 296
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x00667000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 296
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x00666000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 296
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x0064a000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 296
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x00a61000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 1236
region_size: 65536
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x0000000004b60000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffffffffffff
1 0 0
file C:\Users\test22\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\%startupname%.lnk
file C:\Users\test22\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\%startupname%.lnk
description Take ScreenShot rule ScreenShot
description Code injection with CreateRemoteThread in a remote process rule Code_injection
description PWS Memory rule Generic_PWS_Memory_Zero
description (no description) rule DebuggerCheck__GlobalFlags
description (no description) rule DebuggerCheck__QueryInfo
description (no description) rule DebuggerHiding__Thread
description (no description) rule DebuggerHiding__Active
description (no description) rule ThreadControl__Context
description (no description) rule SEH__vectored
description Checks if being debugged rule anti_dbg
description Bypass DEP rule disable_dep
buffer Buffer with sha1: 4cecf16c67f7eb7bd9d76ff58ad1447731f88ffc
buffer Buffer with sha1: a890ce05528d2982fd6e718ddb4f6024a456686a
host 217.64.31.3
Time & API Arguments Status Return Repeated

NtAllocateVirtualMemory

 process_identifier: 2184
region_size: 73728
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x00400000
allocation_type: 12288 (MEM_COMMIT|MEM_RESERVE)
process_handle: 0x00000390
1 0 0
file C:\Users\test22\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\%startupname%.lnk
Process injection Process 296 manipulating memory of non-child process 2184
Time & API Arguments Status Return Repeated

NtAllocateVirtualMemory

 process_identifier: 2184
region_size: 73728
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x00400000
allocation_type: 12288 (MEM_COMMIT|MEM_RESERVE)
process_handle: 0x00000390
1 0 0
Process injection Process 296 injected into non-child 2184
Time & API Arguments Status Return Repeated

WriteProcessMemory

 buffer: MZÿÿ¸@€º´ Í!¸LÍ!This program cannot be run in DOS mode. $PEL “`à ®.Ì à@  @…ØËSà  H.text4¬ ® `.rsrcà°@@.reloc À@B
base_address: 0x00400000
process_identifier: 2184
process_handle: 0x00000390
1 1 0

WriteProcessMemory

 buffer: À 0<
base_address: 0x00410000
process_identifier: 2184
process_handle: 0x00000390
1 1 0

WriteProcessMemory

 buffer: @
base_address: 0x7efde008
process_identifier: 2184
process_handle: 0x00000390
1 1 0
Process injection Process 296 injected into non-child 2184
Time & API Arguments Status Return Repeated

WriteProcessMemory

 buffer: MZÿÿ¸@€º´ Í!¸LÍ!This program cannot be run in DOS mode. $PEL “`à ®.Ì à@  @…ØËSà  H.text4¬ ® `.rsrcà°@@.reloc À@B
base_address: 0x00400000
process_identifier: 2184
process_handle: 0x00000390
1 1 0
Process injection Process 296 called NtSetContextThread to modify thread in remote process 2184
Time & API Arguments Status Return Repeated

NtSetContextThread

 registers.eip: 0
registers.esp: 0
registers.edi: 0
registers.eax: 4246574
registers.ebp: 0
registers.edx: 0
registers.ebx: 2130567168
registers.esi: 0
registers.ecx: 0
thread_handle: 0x00000394
process_identifier: 2184
1 0 0
Process injection Process 296 resumed a thread in remote process 2184
Time & API Arguments Status Return Repeated

NtResumeThread

 thread_handle: 0x00000394
suspend_count: 1
process_identifier: 2184
1 0 0
dead_host 217.64.31.3:9742
Time & API Arguments Status Return Repeated

NtResumeThread

 thread_handle: 0x000000dc
suspend_count: 1
process_identifier: 296
1 0 0

NtResumeThread

 thread_handle: 0x00000154
suspend_count: 1
process_identifier: 296
1 0 0

NtResumeThread

 thread_handle: 0x00000190
suspend_count: 1
process_identifier: 296
1 0 0

CreateProcessInternalW

 thread_identifier: 2188
thread_handle: 0x00000394
process_identifier: 2184
current_directory:
filepath: C:\Users\test22\AppData\Local\Temp\lastdc.exe
track: 1
command_line:
filepath_r: C:\Users\test22\AppData\Local\Temp\lastdc.exe
stack_pivoted: 0
creation_flags: 134217732 (CREATE_NO_WINDOW|CREATE_SUSPENDED)
inherit_handles: 0
process_handle: 0x00000390
1 1 0

NtGetContextThread

 thread_handle: 0x00000394
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2184
region_size: 73728
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x00400000
allocation_type: 12288 (MEM_COMMIT|MEM_RESERVE)
process_handle: 0x00000390
1 0 0

WriteProcessMemory

 buffer: MZÿÿ¸@€º´ Í!¸LÍ!This program cannot be run in DOS mode. $PEL “`à ®.Ì à@  @…ØËSà  H.text4¬ ® `.rsrcà°@@.reloc À@B
base_address: 0x00400000
process_identifier: 2184
process_handle: 0x00000390
1 1 0

WriteProcessMemory

 buffer:
base_address: 0x00402000
process_identifier: 2184
process_handle: 0x00000390
1 1 0

WriteProcessMemory

 buffer:
base_address: 0x0040e000
process_identifier: 2184
process_handle: 0x00000390
1 1 0

WriteProcessMemory

 buffer: À 0<
base_address: 0x00410000
process_identifier: 2184
process_handle: 0x00000390
1 1 0

WriteProcessMemory

 buffer: @
base_address: 0x7efde008
process_identifier: 2184
process_handle: 0x00000390
1 1 0

NtSetContextThread

 registers.eip: 0
registers.esp: 0
registers.edi: 0
registers.eax: 4246574
registers.ebp: 0
registers.edx: 0
registers.ebx: 2130567168
registers.esi: 0
registers.ecx: 0
thread_handle: 0x00000394
process_identifier: 2184
1 0 0

NtResumeThread

 thread_handle: 0x00000394
suspend_count: 1
process_identifier: 2184
1 0 0
Bkav W32.AIDetectNet.01
Elastic malicious (high confidence)
MicroWorld-eScan IL:Trojan.MSILZilla.26093
FireEye IL:Trojan.MSILZilla.26093
McAfee GenericRXVN-CF!2D0CC7C5C995
Malwarebytes Malware.AI.4177324091
CrowdStrike win/malicious_confidence_90% (D)
Symantec ML.Attribute.HighConfidence
ESET-NOD32 a variant of MSIL/TrojanDownloader.Agent.NEN
Cynet Malicious (score: 100)
APEX Malicious
Kaspersky HEUR:Trojan-Spy.MSIL.SnakeLogger.gen
BitDefender IL:Trojan.MSILZilla.26093
Avast Win32:Trojan-gen
Tencent Msil.Trojan-Downloader.Ader.Rqil
Emsisoft IL:Trojan.MSILZilla.26093 (B)
VIPRE IL:Trojan.MSILZilla.26093
McAfee-GW-Edition GenericRXVN-CF!2D0CC7C5C995
Avira TR/Dldr.Agent.iqano
MAX malware (ai score=88)
Microsoft Trojan:MSIL/AveMaria.NECT!MTB
Arcabit IL:Trojan.MSILZilla.D65ED
GData IL:Trojan.MSILZilla.26093
Google Detected
AhnLab-V3 Infostealer/Win.RequestPOST.C5337962
BitDefenderTheta Gen:NN.ZemsilF.36344.Mo0@auhmuz
ALYac IL:Trojan.MSILZilla.26093
VBA32 OScope.Malware-Cryptor.MSIL.Agent
Rising Spyware.SnakeLogger!8.15FDD (TFE:D:IcCRlUc0v4S)
Fortinet MSIL/Agent.MQA!tr
AVG Win32:Trojan-gen