Summary | ZeroBOX

Category	Machine	Started	Completed
FILE	s1_win7_x6401	March 23, 2023, 1:01 p.m.	March 23, 2023, 1:05 p.m.

Size	175.0KB
Type	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
MD5	`ab64460cd667c1964fc0ee034ec60d15`
SHA256	`7a762cd556ed7f6246e19b479783886714833f25e614e7ed922b2e1aae28e2ec`
CRC32	`5AD0C5F6`
ssdeep	`3072:IxqZWRZaPkOQ3rbep5FCh1XxNn2pU9f2MKTV/wi4lr55R9TxlnsPsUw0jOuw+caH:2qZorYCh`
Yara	UPX_Zero - UPX packed file OS_Processor_Check_Zero - OS Processor Check Win32_Trojan_PWS_Net_1_Zero - Win32 Trojan PWS .NET Azorult Is_DotNET_EXE - (no description) Win_Backdoor_AsyncRAT_Zero - Win Backdoor AsyncRAT IsPE32 - (no description) PE_Header_Zero - PE File Signature

myp.exe "C:\Users\test22\AppData\Local\Temp\myp.exe"
2552

Name	Response	Post-Analysis Lookup
No hosts contacted.

IP Address	Status	Action
195.133.40.209	Active	Moloch

Suricata Alerts

No Suricata Alerts

Suricata TLS

No Suricata TLS

Checks if process is being debugged by a debugger (2 events)

Time & API	Arguments	Status	Return	Repeated
IsDebuggerPresent March 23, 2023, 1:01 p.m.			0	0
IsDebuggerPresent March 23, 2023, 1:01 p.m.			0	0

Uses Windows APIs to generate a cryptographic key (14 events)

Time & API	Arguments	Status	Return
CryptExportKey March 23, 2023, 1:01 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x0069b168 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey March 23, 2023, 1:01 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x0069b168 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey March 23, 2023, 1:01 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x0069b168 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey March 23, 2023, 1:01 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x0069b168 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey March 23, 2023, 1:01 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x0069b1e8 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey March 23, 2023, 1:01 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x0069b1e8 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey March 23, 2023, 1:01 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x0069b0e8 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey March 23, 2023, 1:01 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x0069b0e8 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey March 23, 2023, 1:01 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x0069b0e8 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey March 23, 2023, 1:01 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x0069b0e8 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey March 23, 2023, 1:01 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x0069b0e8 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey March 23, 2023, 1:01 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x0069b168 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey March 23, 2023, 1:01 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x0069b168 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey March 23, 2023, 1:01 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x0069b368 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1

Checks amount of memory in system, this can be used to detect virtual machines that have a low amount of memory available (1 event)

Time & API	Arguments	Status	Return	Repeated
GlobalMemoryStatusEx March 23, 2023, 1:01 p.m.		1	1	0

Allocates read-write-execute memory (usually to unpack itself) (32 events)

Time & API	Arguments	Status
NtAllocateVirtualMemory March 23, 2023, 1:01 p.m.	process_identifier: 2552 region_size: 2162688 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00780000 allocation_type: 8192 (MEM_RESERVE) process_handle: 0xffffffff	1
NtAllocateVirtualMemory March 23, 2023, 1:01 p.m.	process_identifier: 2552 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00950000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtProtectVirtualMemory March 23, 2023, 1:01 p.m.	process_identifier: 2552 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x727a1000 process_handle: 0xffffffff	1
NtProtectVirtualMemory March 23, 2023, 1:01 p.m.	process_identifier: 2552 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x727a2000 process_handle: 0xffffffff	1
NtAllocateVirtualMemory March 23, 2023, 1:01 p.m.	process_identifier: 2552 region_size: 1048576 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00b20000 allocation_type: 8192 (MEM_RESERVE) process_handle: 0xffffffff	1
NtAllocateVirtualMemory March 23, 2023, 1:01 p.m.	process_identifier: 2552 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00be0000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory March 23, 2023, 1:01 p.m.	process_identifier: 2552 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00392000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory March 23, 2023, 1:01 p.m.	process_identifier: 2552 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x003d5000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory March 23, 2023, 1:01 p.m.	process_identifier: 2552 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x003db000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory March 23, 2023, 1:01 p.m.	process_identifier: 2552 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x003d7000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory March 23, 2023, 1:01 p.m.	process_identifier: 2552 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x003ac000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory March 23, 2023, 1:01 p.m.	process_identifier: 2552 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00660000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory March 23, 2023, 1:01 p.m.	process_identifier: 2552 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0039a000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory March 23, 2023, 1:01 p.m.	process_identifier: 2552 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00661000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory March 23, 2023, 1:01 p.m.	process_identifier: 2552 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x003b6000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory March 23, 2023, 1:01 p.m.	process_identifier: 2552 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x003ba000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory March 23, 2023, 1:01 p.m.	process_identifier: 2552 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x003b7000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory March 23, 2023, 1:01 p.m.	process_identifier: 2552 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x003bb000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory March 23, 2023, 1:01 p.m.	process_identifier: 2552 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x003aa000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory March 23, 2023, 1:01 p.m.	process_identifier: 2552 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x003bc000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory March 23, 2023, 1:01 p.m.	process_identifier: 2552 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0039c000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory March 23, 2023, 1:01 p.m.	process_identifier: 2552 region_size: 327680 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x7ef50000 allocation_type: 1056768 (MEM_RESERVE\|MEM_TOP_DOWN) process_handle: 0xffffffff	1
NtAllocateVirtualMemory March 23, 2023, 1:01 p.m.	process_identifier: 2552 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x7ef50000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory March 23, 2023, 1:01 p.m.	process_identifier: 2552 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x7ef50000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory March 23, 2023, 1:01 p.m.	process_identifier: 2552 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x7ef58000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory March 23, 2023, 1:01 p.m.	process_identifier: 2552 region_size: 65536 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x7ef40000 allocation_type: 1056768 (MEM_RESERVE\|MEM_TOP_DOWN) process_handle: 0xffffffff	1
NtAllocateVirtualMemory March 23, 2023, 1:01 p.m.	process_identifier: 2552 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x7ef40000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory March 23, 2023, 1:01 p.m.	process_identifier: 2552 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x7ef50000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory March 23, 2023, 1:01 p.m.	process_identifier: 2552 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x7ef58000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory March 23, 2023, 1:01 p.m.	process_identifier: 2552 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x7ef40000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory March 23, 2023, 1:01 p.m.	process_identifier: 2552 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x003bd000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory March 23, 2023, 1:01 p.m.	process_identifier: 2552 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x003b8000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1

A process attempted to delay the analysis task. (1 event)

description

myp.exe tried to sleep 145 seconds, actually delayed analysis time by 145 seconds

Communicates with host for which no DNS query was performed (1 event)

host

195.133.40.209

File has been identified by 58 AntiVirus engines on VirusTotal as malicious (50 out of 58 events)

Bkav	W32.AIDetectNet.01
Lionic	Trojan.Win32.Agent.Y!c
Elastic	malicious (high confidence)
MicroWorld-eScan	Trojan.GenericKDZ.94427
FireEye	Generic.mg.ab64460cd667c196
CAT-QuickHeal	Trojan.Generic.TRFH758
McAfee	AgentTesla-FCYU!AB64460CD667
Cylance	unsafe
Sangfor	Infostealer.Msil.Redline.Vl6z
CrowdStrike	win/malicious_confidence_100% (W)
Alibaba	Trojan:MSIL/Redline.47f371ec
K7GW	Trojan ( 700000121 )
K7AntiVirus	Trojan ( 700000121 )
Arcabit	Trojan.Generic.D170DB
VirIT	Trojan.Win32.Genus.NWT
Cyren	W32/MSIL_Kryptik.ITJ.gen!Eldorado
Symantec	Trojan.Whispergate
ESET-NOD32	a variant of MSIL/Spy.RedLine.A
Cynet	Malicious (score: 100)
APEX	Malicious
Paloalto	generic.ml
ClamAV	Win.Trojan.Generic-9933689-0
Kaspersky	HEUR:Trojan.MSIL.Agent.gen
BitDefender	Trojan.GenericKDZ.94427
ViRobot	Trojan.Win.Z.Redline.179200.DL
Avast	Win32:PWSX-gen [Trj]
Tencent	Trojan-Psw.Win32.Stealer.16000501
Emsisoft	Trojan.GenericKDZ.94427 (B)
DrWeb	Trojan.PWS.Stealer.35327
VIPRE	Trojan.GenericKDZ.94427
TrendMicro	TrojanSpy.Win32.REDLINE.YXDCVZ
McAfee-GW-Edition	BehavesLike.Win32.AgentTesla.ct
Sophos	Mal/Reline-B
SentinelOne	Static AI - Suspicious PE
Webroot	W32.Malware.Gen
Avira	HEUR/AGEN.1307453
Antiy-AVL	Trojan[Spy]/MSIL.RedLine
Gridinsoft	Malware.Win32.RedLine.bot
Microsoft	Trojan:MSIL/Redline.R!MTB
SUPERAntiSpyware	Trojan.Agent/Gen-Crypt
ZoneAlarm	HEUR:Trojan.MSIL.Agent.gen
GData	MSIL.Trojan-Stealer.Redline.G
Google	Detected
AhnLab-V3	Infostealer/Win.RedLine.C5321976
Acronis	suspicious
VBA32	Trojan.MSIL.InfoStealer.gen.U
ALYac	Trojan.GenericKDZ.94427
MAX	malware (ai score=81)
Malwarebytes	Spyware.PasswordStealer.MSIL
TrendMicro-HouseCall	TrojanSpy.Win32.REDLINE.YXDCVZ

Connects to IP addresses that are no longer responding to requests (legitimate services will remain up-and-running usually) (18 events)

dead_host	192.168.56.101:49181
dead_host	192.168.56.101:49180
dead_host	195.133.40.209:13527
dead_host	192.168.56.101:49171
dead_host	192.168.56.101:49170
dead_host	192.168.56.101:49167
dead_host	192.168.56.101:49169
dead_host	192.168.56.101:49166
dead_host	192.168.56.101:49168
dead_host	192.168.56.101:49165
dead_host	192.168.56.101:49178
dead_host	192.168.56.101:49175
dead_host	192.168.56.101:49174
dead_host	192.168.56.101:49176
dead_host	192.168.56.101:49173
dead_host	192.168.56.101:49172
dead_host	192.168.56.101:49182
dead_host	192.168.56.101:49163

myp.exe

Process Tree Toggle all

Network Toggle all

Suricata Toggle all

Suricata Alerts

Suricata TLS

Signatures Toggle All