Summary | ZeroBOX

Category	Machine	Started	Completed
FILE	s1_win7_x6402	March 21, 2023, 1:35 p.m.	March 21, 2023, 1:37 p.m.

Size	8.2MB
Type	PE32+ executable (GUI) x86-64, for MS Windows
MD5	`163d4e2d75f8ce6c838bab888bf9629c`
SHA256	`b1ef1654839b73f03b73c4ef4e20ce4ecdef2236ec6e1ca36881438bc1758dcd`
CRC32	`8B75EE82`
ssdeep	`196608:0ZzXM8K/p32xbAQveItwq+ZkiKDItdc7x0vjPYxXLJ:aML/oxvxaq+ZkFwux0je`
Yara	UPX_Zero - UPX packed file Malicious_Library_Zero - Malicious_Library OS_Processor_Check_Zero - OS Processor Check IsPE64 - (no description) PE_Header_Zero - PE File Signature

Lst.exe "C:\Users\test22\AppData\Local\Temp\Lst.exe"
3060
- Lst.exe "C:\Users\test22\AppData\Local\Temp\Lst.exe"
  2228

Name	Response	Post-Analysis Lookup
No hosts contacted.

IP Address	Status	Action
164.124.101.2	Active	Moloch

Suricata Alerts

No Suricata Alerts

Suricata TLS

No Suricata TLS

Checks amount of memory in system, this can be used to detect virtual machines that have a low amount of memory available (1 event)

Time & API	Arguments	Status	Return	Repeated
GlobalMemoryStatusEx March 21, 2023, 1:28 p.m.		1	1	0

The executable contains unknown PE section names indicative of a packer (could be a false positive) (1 event)

section

_RDATA

One or more processes crashed (1 event)

Time & API	Arguments	Status	Return	Repeated
__exception__ March 21, 2023, 1:28 p.m.	stacktrace: CtfImeIsIME+0x8530 TF_IsCtfmonRunning-0xe28 msctf+0x4a278 @ 0x7fefe25a278 TF_IsCtfmonRunning+0x2f4 TF_RunInputCPL-0x1a19c msctf+0x4b394 @ 0x7fefe25b394 SetInputScope+0x4662 DllRegisterServer-0x10f5e msctf+0x2e1e2 @ 0x7fefe23e1e2 TF_GetInputScope+0x19f3 CtfImeDestroyThreadMgr-0x20a9 msctf+0x14bcb @ 0x7fefe224bcb TF_GetInputScope+0x2ae9 CtfImeDestroyThreadMgr-0xfb3 msctf+0x15cc1 @ 0x7fefe225cc1 TF_CanUninitialize+0x74 CtfNotifyIME-0x1318 msctf+0x21ea4 @ 0x7fefe231ea4 TF_CleanUpPrivateMessages+0xf48 DllGetClassObject-0x514 msctf+0x180d4 @ 0x7fefe2280d4 TF_CleanUpPrivateMessages+0xf26 DllGetClassObject-0x536 msctf+0x180b2 @ 0x7fefe2280b2 TF_CleanUpPrivateMessages+0xc7b DllGetClassObject-0x7e1 msctf+0x17e07 @ 0x7fefe227e07 TF_CleanUpPrivateMessages+0xbb8 DllGetClassObject-0x8a4 msctf+0x17d44 @ 0x7fefe227d44 RtlProcessFlsData+0x84 LdrUnlockLoaderLock-0x7c ntdll+0x2b894 @ 0x772bb894 LdrShutdownProcess+0xa9 NtdllDialogWndProc_W-0x43b ntdll+0x24249 @ 0x772b4249 RtlExitUserProcess+0x90 LdrShutdownProcess-0x20 ntdll+0x24180 @ 0x772b4180 lst+0x188b9 @ 0x13fe088b9 lst+0x18884 @ 0x13fe08884 lst+0xb304 @ 0x13fdfb304 BaseThreadInitThunk+0xd CreateThread-0x53 kernel32+0x1652d @ 0x7718652d RtlUserThreadStart+0x21 strchr-0x3df ntdll+0x2c521 @ 0x772bc521 exception.instruction_r: ff 50 18 89 9e f8 08 00 00 48 3b fb 74 28 48 39 exception.symbol: CtfImeIsIME+0x8530 TF_IsCtfmonRunning-0xe28 msctf+0x4a278 exception.instruction: call qword ptr [rax + 0x18] exception.module: MSCTF.dll exception.exception_code: 0xc0000005 exception.offset: 303736 exception.address: 0x7fefe25a278 registers.r14: 0 registers.r15: 0 registers.rcx: 44285328 registers.rsi: 0 registers.r10: 1 registers.rbx: 0 registers.rsp: 3340272 registers.r11: 0 registers.r8: 3338864 registers.r9: 0 registers.rdx: 0 registers.r12: 0 registers.rbp: 0 registers.rdi: 0 registers.rax: 8791641515336 registers.r13: 0	1	0	0

Time & API

Arguments

Status

Return

Repeated

__exception__

March 21, 2023, 1:28 p.m.

stacktrace:

CtfImeIsIME+0x8530 TF_IsCtfmonRunning-0xe28 msctf+0x4a278 @ 0x7fefe25a278
TF_IsCtfmonRunning+0x2f4 TF_RunInputCPL-0x1a19c msctf+0x4b394 @ 0x7fefe25b394
SetInputScope+0x4662 DllRegisterServer-0x10f5e msctf+0x2e1e2 @ 0x7fefe23e1e2
TF_GetInputScope+0x19f3 CtfImeDestroyThreadMgr-0x20a9 msctf+0x14bcb @ 0x7fefe224bcb
TF_GetInputScope+0x2ae9 CtfImeDestroyThreadMgr-0xfb3 msctf+0x15cc1 @ 0x7fefe225cc1
TF_CanUninitialize+0x74 CtfNotifyIME-0x1318 msctf+0x21ea4 @ 0x7fefe231ea4
TF_CleanUpPrivateMessages+0xf48 DllGetClassObject-0x514 msctf+0x180d4 @ 0x7fefe2280d4
TF_CleanUpPrivateMessages+0xf26 DllGetClassObject-0x536 msctf+0x180b2 @ 0x7fefe2280b2
TF_CleanUpPrivateMessages+0xc7b DllGetClassObject-0x7e1 msctf+0x17e07 @ 0x7fefe227e07
TF_CleanUpPrivateMessages+0xbb8 DllGetClassObject-0x8a4 msctf+0x17d44 @ 0x7fefe227d44
RtlProcessFlsData+0x84 LdrUnlockLoaderLock-0x7c ntdll+0x2b894 @ 0x772bb894
LdrShutdownProcess+0xa9 NtdllDialogWndProc_W-0x43b ntdll+0x24249 @ 0x772b4249
RtlExitUserProcess+0x90 LdrShutdownProcess-0x20 ntdll+0x24180 @ 0x772b4180
lst+0x188b9 @ 0x13fe088b9
lst+0x18884 @ 0x13fe08884
lst+0xb304 @ 0x13fdfb304
BaseThreadInitThunk+0xd CreateThread-0x53 kernel32+0x1652d @ 0x7718652d
RtlUserThreadStart+0x21 strchr-0x3df ntdll+0x2c521 @ 0x772bc521

exception.instruction_r: ff 50 18 89 9e f8 08 00 00 48 3b fb 74 28 48 39
exception.symbol: CtfImeIsIME+0x8530 TF_IsCtfmonRunning-0xe28 msctf+0x4a278
exception.instruction: call qword ptr [rax + 0x18]
exception.module: MSCTF.dll
exception.exception_code: 0xc0000005
exception.offset: 303736
exception.address: 0x7fefe25a278
registers.r14: 0
registers.r15: 0
registers.rcx: 44285328
registers.rsi: 0
registers.r10: 1
registers.rbx: 0
registers.rsp: 3340272
registers.r11: 0
registers.r8: 3338864
registers.r9: 0
registers.rdx: 0
registers.r12: 0
registers.rbp: 0
registers.rdi: 0
registers.rax: 8791641515336
registers.r13: 0

Allocates read-write-execute memory (usually to unpack itself) (1 event)

Time & API	Arguments	Status	Return	Repeated
NtProtectVirtualMemory March 21, 2023, 1:28 p.m.	process_identifier: 2228 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fef69c9000 process_handle: 0xffffffffffffffff	1	0	0

Creates executable files on the filesystem (8 events)

file	C:\Users\test22\AppData\Local\Temp\_MEI30602\sqlite3.dll
file	C:\Users\test22\AppData\Local\Temp\_MEI30602\python310.dll
file	C:\Users\test22\AppData\Local\Temp\_MEI30602\VCRUNTIME140.dll
file	C:\Users\test22\AppData\Local\Temp\_MEI30602\pywin32_system32\pywintypes310.dll
file	C:\Users\test22\AppData\Local\Temp\_MEI30602\libcrypto-1_1.dll
file	C:\Users\test22\AppData\Local\Temp\_MEI30602\libffi-7.dll
file	C:\Users\test22\AppData\Local\Temp\_MEI30602\libssl-1_1.dll
file	C:\Users\test22\AppData\Local\Temp\_MEI30602\_pytransform.dll

File has been identified by 8 AntiVirus engines on VirusTotal as malicious (8 events)

Cynet	Malicious (score: 100)
FireEye	Generic.mg.163d4e2d75f8ce6c
CrowdStrike	win/malicious_confidence_90% (D)
Avast	Win64:Trojan-gen
McAfee-GW-Edition	BehavesLike.Win64.Ransom.rc
Jiangmin	Trojan.Generic.horqm
Antiy-AVL	Trojan[PSW]/Python.Disco
AVG	Win64:Trojan-gen

The binary likely contains encrypted or compressed data indicative of a packer (1 event)

section

{u'size_of_data': u'0x0000f600', u'virtual_address': u'0x00052000', u'entropy': 7.5555924277072215, u'name': u'.rsrc', u'virtual_size': u'0x0000f49c'}

entropy

7.55559242771

description

A section with a high entropy has been found

Lst.exe

Process Tree Toggle all

Network Toggle all

Suricata Toggle all

Suricata Alerts

Suricata TLS

Signatures Toggle All