Summary | ZeroBOX

Category	Machine	Started	Completed
FILE	s1_win7_x6401	March 21, 2023, 10:04 a.m.	March 21, 2023, 10:06 a.m.

Size	108.0KB
Type	PE32 executable (GUI) Intel 80386, for MS Windows, PECompact2 compressed
MD5	`a6a9abf50eb980d12622e14c237a9f37`
SHA256	`1ef14f23c1c3fad652b81376340e8882a942b27052f85e96040067fc0ac4cd5a`
CRC32	`4734ACF3`
ssdeep	`3072:/3pQItUOllgxfMBZq6oopIISfXfQ9B0nk5tR:P6ObgxUPqaIISfXfQkn4`
Yara	Malicious_Library_Zero - Malicious_Library IsPE32 - (no description) PE_Header_Zero - PE File Signature

laoxiang.exe "C:\Users\test22\AppData\Local\Temp\laoxiang.exe"
2564

Name	Response	Post-Analysis Lookup
No hosts contacted.

IP Address	Status	Action
202.146.218.59	Active	Moloch

Suricata Alerts

No Suricata Alerts

Suricata TLS

No Suricata TLS

Checks if process is being debugged by a debugger (1 event)

Time & API	Arguments	Status	Return	Repeated
IsDebuggerPresent March 21, 2023, 10:04 a.m.			0	0

Checks amount of memory in system, this can be used to detect virtual machines that have a low amount of memory available (1 event)

Time & API	Arguments	Status	Return	Repeated
GlobalMemoryStatusEx March 21, 2023, 10:04 a.m.		1	1	0

The executable uses a known packer (1 event)

packer

PECompact 2.xx --> BitSum Technologies

One or more processes crashed (1 event)

Time & API	Arguments	Status	Return	Repeated
__exception__ March 21, 2023, 10:04 a.m.	stacktrace: RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x76f49ed2 RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x76f49ea5 exception.instruction_r: 89 08 50 45 43 6f 6d 70 61 63 74 32 00 d8 3c 46 exception.symbol: laoxiang+0x19abd exception.instruction: mov dword ptr [eax], ecx exception.module: laoxiang.exe exception.exception_code: 0xc0000005 exception.offset: 105149 exception.address: 0xcd9abd registers.esp: 3602508 registers.edi: 0 registers.eax: 0 registers.ebp: 3602524 registers.edx: 13474471 registers.ebx: 2130567168 registers.esi: 0 registers.ecx: 0	1	0	0

Allocates read-write-execute memory (usually to unpack itself) (2 events)

Time & API	Arguments	Status	Return	Repeated
NtAllocateVirtualMemory March 21, 2023, 10:04 a.m.	process_identifier: 2564 region_size: 16384 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00210000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1	0	0
NtProtectVirtualMemory March 21, 2023, 10:04 a.m.	process_identifier: 2564 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x735e2000 process_handle: 0xffffffff	1	0	0

Checks whether any human activity is being performed by constantly checking whether the foreground window changed

A process attempted to delay the analysis task. (1 event)

description

laoxiang.exe tried to sleep 304 seconds, actually delayed analysis time by 304 seconds

Queries the disk size which could be used to detect virtual machine with small fixed size or dynamic allocation (1 event)

Time & API	Arguments	Status	Return	Repeated
GetDiskFreeSpaceExW March 21, 2023, 10:04 a.m.	total_number_of_free_bytes: 13323743232 free_bytes_available: 13323743232 root_path: C:\ total_number_of_bytes: 34252779520	1	1	0

Searches running processes potentially to identify processes for sandbox evasion, code injection or memory dumping (2 events)

Time & API	Arguments	Status	Return	Repeated
Process32NextW March 21, 2023, 10:04 a.m.	snapshot_handle: 0x00000310 process_name: schtasks.exe process_identifier: 2644	1	1	0
Process32NextW March 21, 2023, 10:04 a.m.	snapshot_handle: 0x00000310 process_name: conhost.exe process_identifier: 2652	1	1	0

The binary likely contains encrypted or compressed data indicative of a packer (3 events)

section

{u'size_of_data': u'0x00019400', u'virtual_address': u'0x00001000', u'entropy': 7.998216726578852, u'name': u'.text', u'virtual_size': u'0x00048000'}

entropy

7.99821672658

description

A section with a high entropy has been found

section

{u'size_of_data': u'0x00001600', u'virtual_address': u'0x00049000', u'entropy': 7.520461333699418, u'name': u'.rsrc', u'virtual_size': u'0x00002000'}

entropy

7.5204613337

description

A section with a high entropy has been found

entropy

0.995327102804

description

Overall entropy of this PE file is high

Repeatedly searches for a not-found process, you may want to run a web browser during analysis (36 events)

Time & API	Arguments	Status	Return	Repeated
Process32NextW March 21, 2023, 10:04 a.m.	snapshot_handle: 0x00000300 process_name: laoxiang.exe process_identifier: 2564		0	0
Process32NextW March 21, 2023, 10:04 a.m.	snapshot_handle: 0x00000300 process_name: laoxiang.exe process_identifier: 2564		0	0
Process32NextW March 21, 2023, 10:04 a.m.	snapshot_handle: 0x00000300 process_name: laoxiang.exe process_identifier: 2564		0	0
Process32NextW March 21, 2023, 10:04 a.m.	snapshot_handle: 0x00000300 process_name: laoxiang.exe process_identifier: 2564		0	0
Process32NextW March 21, 2023, 10:04 a.m.	snapshot_handle: 0x00000300 process_name: laoxiang.exe process_identifier: 2564		0	0
Process32NextW March 21, 2023, 10:04 a.m.	snapshot_handle: 0x00000300 process_name: laoxiang.exe process_identifier: 2564		0	0
Process32NextW March 21, 2023, 10:04 a.m.	snapshot_handle: 0x00000300 process_name: laoxiang.exe process_identifier: 2564		0	0
Process32NextW March 21, 2023, 10:04 a.m.	snapshot_handle: 0x00000300 process_name: laoxiang.exe process_identifier: 2564		0	0
Process32NextW March 21, 2023, 10:04 a.m.	snapshot_handle: 0x00000300 process_name: laoxiang.exe process_identifier: 2564		0	0
Process32NextW March 21, 2023, 10:04 a.m.	snapshot_handle: 0x00000300 process_name: laoxiang.exe process_identifier: 2564		0	0
Process32NextW March 21, 2023, 10:04 a.m.	snapshot_handle: 0x00000300 process_name: laoxiang.exe process_identifier: 2564		0	0
Process32NextW March 21, 2023, 10:04 a.m.	snapshot_handle: 0x00000300 process_name: laoxiang.exe process_identifier: 2564		0	0
Process32NextW March 21, 2023, 10:04 a.m.	snapshot_handle: 0x00000300 process_name: laoxiang.exe process_identifier: 2564		0	0
Process32NextW March 21, 2023, 10:04 a.m.	snapshot_handle: 0x00000300 process_name: laoxiang.exe process_identifier: 2564		0	0
Process32NextW March 21, 2023, 10:04 a.m.	snapshot_handle: 0x00000300 process_name: laoxiang.exe process_identifier: 2564		0	0
Process32NextW March 21, 2023, 10:04 a.m.	snapshot_handle: 0x00000300 process_name: laoxiang.exe process_identifier: 2564		0	0
Process32NextW March 21, 2023, 10:04 a.m.	snapshot_handle: 0x00000300 process_name: laoxiang.exe process_identifier: 2564		0	0
Process32NextW March 21, 2023, 10:04 a.m.	snapshot_handle: 0x00000300 process_name: laoxiang.exe process_identifier: 2564		0	0
Process32NextW March 21, 2023, 10:04 a.m.	snapshot_handle: 0x00000300 process_name: laoxiang.exe process_identifier: 2564		0	0
Process32NextW March 21, 2023, 10:04 a.m.	snapshot_handle: 0x00000300 process_name: laoxiang.exe process_identifier: 2564		0	0
Process32NextW March 21, 2023, 10:04 a.m.	snapshot_handle: 0x00000300 process_name: laoxiang.exe process_identifier: 2564		0	0
Process32NextW March 21, 2023, 10:04 a.m.	snapshot_handle: 0x00000300 process_name: laoxiang.exe process_identifier: 2564		0	0
Process32NextW March 21, 2023, 10:04 a.m.	snapshot_handle: 0x00000300 process_name: laoxiang.exe process_identifier: 2564		0	0
Process32NextW March 21, 2023, 10:04 a.m.	snapshot_handle: 0x00000300 process_name: laoxiang.exe process_identifier: 2564		0	0
Process32NextW March 21, 2023, 10:04 a.m.	snapshot_handle: 0x00000300 process_name: laoxiang.exe process_identifier: 2564		0	0
Process32NextW March 21, 2023, 10:04 a.m.	snapshot_handle: 0x00000300 process_name: laoxiang.exe process_identifier: 2564		0	0
Process32NextW March 21, 2023, 10:04 a.m.	snapshot_handle: 0x00000300 process_name: laoxiang.exe process_identifier: 2564		0	0
Process32NextW March 21, 2023, 10:04 a.m.	snapshot_handle: 0x00000300 process_name: laoxiang.exe process_identifier: 2564		0	0
Process32NextW March 21, 2023, 10:04 a.m.	snapshot_handle: 0x00000300 process_name: laoxiang.exe process_identifier: 2564		0	0
Process32NextW March 21, 2023, 10:04 a.m.	snapshot_handle: 0x00000300 process_name: laoxiang.exe process_identifier: 2564		0	0
Process32NextW March 21, 2023, 10:04 a.m.	snapshot_handle: 0x00000300 process_name: laoxiang.exe process_identifier: 2564		0	0
Process32NextW March 21, 2023, 10:04 a.m.	snapshot_handle: 0x00000300 process_name: laoxiang.exe process_identifier: 2564		0	0
Process32NextW March 21, 2023, 10:04 a.m.	snapshot_handle: 0x00000300 process_name: laoxiang.exe process_identifier: 2564		0	0
Process32NextW March 21, 2023, 10:04 a.m.	snapshot_handle: 0x00000300 process_name: laoxiang.exe process_identifier: 2564		0	0
Process32NextW March 21, 2023, 10:04 a.m.	snapshot_handle: 0x00000300 process_name: laoxiang.exe process_identifier: 2564		0	0
Process32NextW March 21, 2023, 10:04 a.m.	snapshot_handle: 0x00000310 process_name: conhost.exe process_identifier: 2652		0	0

Communicates with host for which no DNS query was performed (1 event)

host

202.146.218.59

Checks the CPU name from registry, possibly for anti-virtualization (1 event)

registry

HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString

Installs an hook procedure to monitor for mouse events (1 event)

Time & API	Arguments	Status	Return	Repeated
SetWindowsHookExW March 21, 2023, 10:04 a.m.	thread_identifier: 0 callback_function: 0x7418c951 hook_identifier: 14 (WH_MOUSE_LL) module_address: 0x74180000	1	5702025	0

File has been identified by 43 AntiVirus engines on VirusTotal as malicious (43 events)

Lionic	Trojan.Win32.NetWiredRC.4!c
MicroWorld-eScan	Generic.Malware.SPVPk!.E723D6C4
FireEye	Generic.mg.a6a9abf50eb980d1
ALYac	Generic.Malware.SPVPk!.E723D6C4
Malwarebytes	Spyware.KeyLogger
Sangfor	Spyware.Win32.KeyLogger.Vpey
CrowdStrike	win/malicious_confidence_70% (W)
Alibaba	TrojanSpy:Win32/KeyLogger.f88464c0
Arcabit	Generic.Malware.SPVPk!.E723D6C4
Symantec	ML.Attribute.HighConfidence
Elastic	malicious (high confidence)
ESET-NOD32	a variant of Win32/Spy.KeyLogger.RJA
Cynet	Malicious (score: 100)
APEX	Malicious
Paloalto	generic.ml
Kaspersky	Backdoor.Win32.NetWiredRC.maf
BitDefender	Generic.Malware.SPVPk!.E723D6C4
Avast	Win32:Trojan-gen
Tencent	Win32.Backdoor.Netwiredrc.Zmhl
VIPRE	Generic.Malware.SPVPk!.E723D6C4
McAfee-GW-Edition	BehavesLike.Win32.Trojan.cc
Trapmine	malicious.moderate.ml.score
Emsisoft	Generic.Malware.SPVPk!.E723D6C4 (B)
SentinelOne	Static AI - Suspicious PE
Webroot	W32.Malware.Gen
Avira	TR/Spy.KeyLogger.fvubr
Antiy-AVL	Trojan[Spy]/Win32.KeyLogger
Xcitium	Malware@#3i2kt6cvp1358
Microsoft	Trojan:Win32/Casdet!rfn
ZoneAlarm	Backdoor.Win32.NetWiredRC.maf
GData	Generic.Malware.SPVPk!.E723D6C4
Google	Detected
McAfee	RDN/Generic PWS.y
MAX	malware (ai score=83)
VBA32	BScope.TrojanSpy.Win64.AntiAV
Cylance	unsafe
TrendMicro-HouseCall	TROJ_GEN.R002H0DCK23
Rising	Backdoor.NetWiredRC!8.2AF (CLOUD)
Ikarus	Trojan-Spy.Win32.KeyLogger
MaxSecure	Trojan.Malware.300983.susgen
Fortinet	PossibleThreat.RF
BitDefenderTheta	Gen:NN.ZexaF.36344.gmWfamFS1kki
AVG	Win32:Trojan-gen

laoxiang.exe

Process Tree Toggle all

Network Toggle all

Suricata Toggle all

Suricata Alerts

Suricata TLS

Signatures Toggle All