popup
Summary | ZeroBOX
  1. Home
  2. Result
  3. Report
  4. Detail Analysis

INV.exe

Malicious Library UPX PE32 PE File
  1. Resubmit sample
Category Machine Started Completed
FILE s1_win7_x6401 March 23, 2023, 6:21 p.m. March 23, 2023, 6:34 p.m.
Size 338.1KB
Type PE32 executable (GUI) Intel 80386, for MS Windows, Nullsoft Installer self-extracting archive
MD5 d826f8c8edb9b4eea8ee18fa75572490
SHA256 896a539c6cb6f313782dc5f1bc8c296abd6732b0907c573ddd12ab9f6a666eb1
CRC32 01BEE637
ssdeep 6144:jYa6WIIzGloikFLNRZiFcDt+MkXb/A+2TMJ2kHzD4kcp:jYxIzECUeYMKb/A+2QJ2afvS
Yara
  • UPX_Zero - UPX packed file
  • Malicious_Library_Zero - Malicious_Library
  • IsPE32 - (no description)
  • PE_Header_Zero - PE File Signature

Suricata Alerts

Flow SID Signature Category
TCP 192.168.56.101:49178 -> 199.192.28.110:80 2023882 ET INFO HTTP Request to a *.top domain Potentially Bad Traffic
UDP 192.168.56.101:54883 -> 164.124.101.2:53 2023883 ET DNS Query to a *.top domain - Likely Hostile Potentially Bad Traffic
TCP 192.168.56.101:49180 -> 74.220.199.6:80 2031412 ET MALWARE FormBook CnC Checkin (GET) Malware Command and Control Activity Detected
TCP 192.168.56.101:49180 -> 74.220.199.6:80 2031449 ET MALWARE FormBook CnC Checkin (GET) Malware Command and Control Activity Detected
TCP 192.168.56.101:49180 -> 74.220.199.6:80 2031453 ET MALWARE FormBook CnC Checkin (GET) Malware Command and Control Activity Detected
TCP 192.168.56.101:49190 -> 192.187.111.219:80 2031412 ET MALWARE FormBook CnC Checkin (GET) Malware Command and Control Activity Detected
TCP 192.168.56.101:49190 -> 192.187.111.219:80 2031449 ET MALWARE FormBook CnC Checkin (GET) Malware Command and Control Activity Detected
TCP 192.168.56.101:49190 -> 192.187.111.219:80 2031453 ET MALWARE FormBook CnC Checkin (GET) Malware Command and Control Activity Detected
TCP 192.168.56.101:49188 -> 23.27.78.200:80 2031412 ET MALWARE FormBook CnC Checkin (GET) Malware Command and Control Activity Detected
TCP 192.168.56.101:49188 -> 23.27.78.200:80 2031449 ET MALWARE FormBook CnC Checkin (GET) Malware Command and Control Activity Detected
TCP 192.168.56.101:49176 -> 185.104.28.238:80 2031412 ET MALWARE FormBook CnC Checkin (GET) Malware Command and Control Activity Detected
TCP 192.168.56.101:49188 -> 23.27.78.200:80 2031453 ET MALWARE FormBook CnC Checkin (GET) Malware Command and Control Activity Detected
TCP 192.168.56.101:49184 -> 148.66.54.130:80 2031412 ET MALWARE FormBook CnC Checkin (GET) Malware Command and Control Activity Detected
TCP 192.168.56.101:49176 -> 185.104.28.238:80 2031449 ET MALWARE FormBook CnC Checkin (GET) Malware Command and Control Activity Detected
TCP 192.168.56.101:49184 -> 148.66.54.130:80 2031449 ET MALWARE FormBook CnC Checkin (GET) Malware Command and Control Activity Detected
TCP 192.168.56.101:49176 -> 185.104.28.238:80 2031453 ET MALWARE FormBook CnC Checkin (GET) Malware Command and Control Activity Detected
TCP 192.168.56.101:49184 -> 148.66.54.130:80 2031453 ET MALWARE FormBook CnC Checkin (GET) Malware Command and Control Activity Detected
TCP 192.168.56.101:49170 -> 103.146.179.136:80 2031412 ET MALWARE FormBook CnC Checkin (GET) Malware Command and Control Activity Detected
TCP 192.168.56.101:49170 -> 103.146.179.136:80 2031449 ET MALWARE FormBook CnC Checkin (GET) Malware Command and Control Activity Detected
TCP 192.168.56.101:49170 -> 103.146.179.136:80 2031453 ET MALWARE FormBook CnC Checkin (GET) Malware Command and Control Activity Detected
TCP 192.168.56.101:49167 -> 217.160.0.91:80 2031412 ET MALWARE FormBook CnC Checkin (GET) Malware Command and Control Activity Detected
TCP 192.168.56.101:49167 -> 217.160.0.91:80 2031449 ET MALWARE FormBook CnC Checkin (GET) Malware Command and Control Activity Detected
TCP 192.168.56.101:49167 -> 217.160.0.91:80 2031453 ET MALWARE FormBook CnC Checkin (GET) Malware Command and Control Activity Detected
TCP 192.168.56.101:49172 -> 64.190.63.111:80 2031412 ET MALWARE FormBook CnC Checkin (GET) Malware Command and Control Activity Detected
TCP 192.168.56.101:49178 -> 199.192.28.110:80 2031412 ET MALWARE FormBook CnC Checkin (GET) Malware Command and Control Activity Detected
TCP 192.168.56.101:49172 -> 64.190.63.111:80 2031449 ET MALWARE FormBook CnC Checkin (GET) Malware Command and Control Activity Detected
TCP 192.168.56.101:49178 -> 199.192.28.110:80 2031449 ET MALWARE FormBook CnC Checkin (GET) Malware Command and Control Activity Detected
TCP 192.168.56.101:49172 -> 64.190.63.111:80 2031453 ET MALWARE FormBook CnC Checkin (GET) Malware Command and Control Activity Detected
TCP 192.168.56.101:49178 -> 199.192.28.110:80 2031453 ET MALWARE FormBook CnC Checkin (GET) Malware Command and Control Activity Detected
TCP 192.168.56.101:49178 -> 199.192.28.110:80 2031089 ET HUNTING Request to .TOP Domain with Minimal Headers Potentially Bad Traffic
TCP 192.168.56.101:49174 -> 23.228.123.194:80 2031412 ET MALWARE FormBook CnC Checkin (GET) Malware Command and Control Activity Detected
TCP 192.168.56.101:49174 -> 23.228.123.194:80 2031449 ET MALWARE FormBook CnC Checkin (GET) Malware Command and Control Activity Detected
TCP 192.168.56.101:49186 -> 76.223.105.230:80 2031412 ET MALWARE FormBook CnC Checkin (GET) Malware Command and Control Activity Detected
TCP 192.168.56.101:49174 -> 23.228.123.194:80 2031453 ET MALWARE FormBook CnC Checkin (GET) Malware Command and Control Activity Detected
TCP 192.168.56.101:49186 -> 76.223.105.230:80 2031449 ET MALWARE FormBook CnC Checkin (GET) Malware Command and Control Activity Detected
TCP 192.168.56.101:49186 -> 76.223.105.230:80 2031453 ET MALWARE FormBook CnC Checkin (GET) Malware Command and Control Activity Detected
TCP 192.168.56.101:49182 -> 165.140.71.65:80 2031412 ET MALWARE FormBook CnC Checkin (GET) Malware Command and Control Activity Detected
TCP 192.168.56.101:49182 -> 165.140.71.65:80 2031449 ET MALWARE FormBook CnC Checkin (GET) Malware Command and Control Activity Detected
TCP 192.168.56.101:49182 -> 165.140.71.65:80 2031453 ET MALWARE FormBook CnC Checkin (GET) Malware Command and Control Activity Detected

Suricata TLS

No Suricata TLS

Time & API Arguments Status Return Repeated

GlobalMemoryStatusEx

 1 1 0
section .ndata
suspicious_features GET method with no useragent header suspicious_request GET http://www.callceylon-infinity.com/hubr/?QCFrH7=QGWktfIAtu18+t6NQORxBTtvzjo+nFqh7PlIya0sAjXty+UNsna0QAVZJMoUGZhtBucAVwHYc/82s4klU8XEeQDHowb765v/cfPxxLM=&RbcWz=XTYFdv
suspicious_features GET method with no useragent header suspicious_request GET http://www.hbslwhcb.com/hubr/?QCFrH7=5E10n45PC8vNB5pZtNj2sXLK8uWSY44i7aDcSA40kUAwhBPRaI2LrW2xciaMt4VcY7NLJleQuynhqBK73YwksAZi1WQgViquW1DW70o=&RbcWz=XTYFdv
suspicious_features GET method with no useragent header suspicious_request GET http://www.betting.style/hubr/?QCFrH7=Igos4DvGYSTYudzWMt6YfvTMrgMRYd/c9vPdAr65R47dBdgzYQRIJWYhFBMjFdvBBv9IJDMtFMntT2Xn4QfH4WErd6ncw9Si7XBW0k4=&RbcWz=XTYFdv
suspicious_features GET method with no useragent header suspicious_request GET http://www.airductshopdk.com/hubr/?QCFrH7=IY6ZMgtXttJgF5cV0sWllCOUaHDATDBCnZNtq8QNvWCyBBYDnskeOxikfpX38PnG5T3Zxr6jgxyRUZdALpyeaupJP3sUL1Dl98sUeiQ=&RbcWz=XTYFdv
suspicious_features GET method with no useragent header suspicious_request GET http://www.bankmobile.online/hubr/?QCFrH7=AqcQf51FHOgh7P9E+wpuxnHpBgBzwI/msQRQ0Dyz8q0S90nTnG8ByyoMHYn461jaf1OBwwUC6quuS4TuPkl+q34PRRmwUjUeIaKK3gY=&RbcWz=XTYFdv
suspicious_features GET method with no useragent header suspicious_request GET http://www.gitmart.top/hubr/?QCFrH7=8LIoJqXtzQoTeM3tSIRjdvK/wvVoI+eZdkhCTWtrmHUI4YaQHcTCw+vN7fasUs/Q0cHIvjOlVkHozVI89gTByPzeHUA52gVSRwAL/jY=&RbcWz=XTYFdv
suspicious_features GET method with no useragent header suspicious_request GET http://www.celestinshipping.org/hubr/?QCFrH7=Vfw1tXj75Mnbbr9waYgxlQ7QagSBA5wKBGGly+Su2Nf6tIgktwqqKgDHr8woq6O0Z5sp1IK/HWsht85Es+CPzw2fwmYXFsAsraj4FMw=&RbcWz=XTYFdv
suspicious_features GET method with no useragent header suspicious_request GET http://www.mtgu.net/hubr/?QCFrH7=BYsUt3owDFJM7GVfuQIWnXwMgDGHBsC/I/b9ZUSfYrqeSV4owQnpPIjIy5UP/vTtTt2F54HHRXV+MLyWN1XqqGr/sjv3aXZqNOI2ujY=&RbcWz=XTYFdv
suspicious_features GET method with no useragent header suspicious_request GET http://www.kahinghk.com/hubr/?QCFrH7=KA2zyijBF8x3Kgke2P+iKCtl6t6cGVl80Cc65JTye6QbcFhOuDw4y56CfsJy2MXD5dQvnaW1nqx7b9Z6wt4S6QZG6sghwLw0rVDMOz0=&RbcWz=XTYFdv
suspicious_features GET method with no useragent header suspicious_request GET http://www.auto-sparepart.com/hubr/?QCFrH7=shp9tHQK/I+jiDz9HZEHJbj1KzHSlPA6IKLbVtcuxb+Os6cPDAiYF95XnY/LnjHwM9ayWNJXkgFRKo9FtI2zAKU8dQudTiqe32jNO5U=&RbcWz=XTYFdv
suspicious_features GET method with no useragent header suspicious_request GET http://www.guochaochao.com/hubr/?QCFrH7=vfnS7kNQ7lGkZwLtMQL9ZqfKyBscb+bEwFm+1uJubApJ6Q5hDNwLUi92Ea3pDCl5aGqTGhnnOe/pMNEIN7harbO0q3jSNOA5A+i+70k=&RbcWz=XTYFdv
suspicious_features GET method with no useragent header suspicious_request GET http://www.asonsrestaurantbar.co.uk/hubr/?QCFrH7=LhIi+kEWCIVSy/fPx6ZU7zxwa0K9qbQ4Avh4ugI75RiAcqy+P9f/TzxibnAgVXMDuzt86sgVXJJMNA/faZ0hFKKpQbAodEvnYLncODA=&RbcWz=XTYFdv
request GET http://www.callceylon-infinity.com/hubr/?QCFrH7=QGWktfIAtu18+t6NQORxBTtvzjo+nFqh7PlIya0sAjXty+UNsna0QAVZJMoUGZhtBucAVwHYc/82s4klU8XEeQDHowb765v/cfPxxLM=&RbcWz=XTYFdv
request GET http://www.sqlite.org/2019/sqlite-dll-win32-x86-3270000.zip
request POST http://www.hbslwhcb.com/hubr/
request GET http://www.hbslwhcb.com/hubr/?QCFrH7=5E10n45PC8vNB5pZtNj2sXLK8uWSY44i7aDcSA40kUAwhBPRaI2LrW2xciaMt4VcY7NLJleQuynhqBK73YwksAZi1WQgViquW1DW70o=&RbcWz=XTYFdv
request POST http://www.betting.style/hubr/
request GET http://www.betting.style/hubr/?QCFrH7=Igos4DvGYSTYudzWMt6YfvTMrgMRYd/c9vPdAr65R47dBdgzYQRIJWYhFBMjFdvBBv9IJDMtFMntT2Xn4QfH4WErd6ncw9Si7XBW0k4=&RbcWz=XTYFdv
request POST http://www.airductshopdk.com/hubr/
request GET http://www.airductshopdk.com/hubr/?QCFrH7=IY6ZMgtXttJgF5cV0sWllCOUaHDATDBCnZNtq8QNvWCyBBYDnskeOxikfpX38PnG5T3Zxr6jgxyRUZdALpyeaupJP3sUL1Dl98sUeiQ=&RbcWz=XTYFdv
request POST http://www.bankmobile.online/hubr/
request GET http://www.bankmobile.online/hubr/?QCFrH7=AqcQf51FHOgh7P9E+wpuxnHpBgBzwI/msQRQ0Dyz8q0S90nTnG8ByyoMHYn461jaf1OBwwUC6quuS4TuPkl+q34PRRmwUjUeIaKK3gY=&RbcWz=XTYFdv
request POST http://www.gitmart.top/hubr/
request GET http://www.gitmart.top/hubr/?QCFrH7=8LIoJqXtzQoTeM3tSIRjdvK/wvVoI+eZdkhCTWtrmHUI4YaQHcTCw+vN7fasUs/Q0cHIvjOlVkHozVI89gTByPzeHUA52gVSRwAL/jY=&RbcWz=XTYFdv
request POST http://www.celestinshipping.org/hubr/
request GET http://www.celestinshipping.org/hubr/?QCFrH7=Vfw1tXj75Mnbbr9waYgxlQ7QagSBA5wKBGGly+Su2Nf6tIgktwqqKgDHr8woq6O0Z5sp1IK/HWsht85Es+CPzw2fwmYXFsAsraj4FMw=&RbcWz=XTYFdv
request POST http://www.mtgu.net/hubr/
request GET http://www.mtgu.net/hubr/?QCFrH7=BYsUt3owDFJM7GVfuQIWnXwMgDGHBsC/I/b9ZUSfYrqeSV4owQnpPIjIy5UP/vTtTt2F54HHRXV+MLyWN1XqqGr/sjv3aXZqNOI2ujY=&RbcWz=XTYFdv
request POST http://www.kahinghk.com/hubr/
request GET http://www.kahinghk.com/hubr/?QCFrH7=KA2zyijBF8x3Kgke2P+iKCtl6t6cGVl80Cc65JTye6QbcFhOuDw4y56CfsJy2MXD5dQvnaW1nqx7b9Z6wt4S6QZG6sghwLw0rVDMOz0=&RbcWz=XTYFdv
request POST http://www.auto-sparepart.com/hubr/
request GET http://www.auto-sparepart.com/hubr/?QCFrH7=shp9tHQK/I+jiDz9HZEHJbj1KzHSlPA6IKLbVtcuxb+Os6cPDAiYF95XnY/LnjHwM9ayWNJXkgFRKo9FtI2zAKU8dQudTiqe32jNO5U=&RbcWz=XTYFdv
request POST http://www.guochaochao.com/hubr/
request GET http://www.guochaochao.com/hubr/?QCFrH7=vfnS7kNQ7lGkZwLtMQL9ZqfKyBscb+bEwFm+1uJubApJ6Q5hDNwLUi92Ea3pDCl5aGqTGhnnOe/pMNEIN7harbO0q3jSNOA5A+i+70k=&RbcWz=XTYFdv
request POST http://www.asonsrestaurantbar.co.uk/hubr/
request GET http://www.asonsrestaurantbar.co.uk/hubr/?QCFrH7=LhIi+kEWCIVSy/fPx6ZU7zxwa0K9qbQ4Avh4ugI75RiAcqy+P9f/TzxibnAgVXMDuzt86sgVXJJMNA/faZ0hFKKpQbAodEvnYLncODA=&RbcWz=XTYFdv
request POST http://www.hbslwhcb.com/hubr/
request POST http://www.betting.style/hubr/
request POST http://www.airductshopdk.com/hubr/
request POST http://www.bankmobile.online/hubr/
request POST http://www.gitmart.top/hubr/
request POST http://www.celestinshipping.org/hubr/
request POST http://www.mtgu.net/hubr/
request POST http://www.kahinghk.com/hubr/
request POST http://www.auto-sparepart.com/hubr/
request POST http://www.guochaochao.com/hubr/
request POST http://www.asonsrestaurantbar.co.uk/hubr/
domain www.gitmart.top description Generic top level domain TLD
Time & API Arguments Status Return Repeated

NtProtectVirtualMemory

 process_identifier: 2568
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x732a2000
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2656
region_size: 8192
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x01c80000
allocation_type: 12288 (MEM_COMMIT|MEM_RESERVE)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2656
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x01c90000
allocation_type: 12289 (MEM_COMMIT|MEM_RESERVE)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2732
region_size: 3158016
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x007e0000
allocation_type: 12288 (MEM_COMMIT|MEM_RESERVE)
process_handle: 0xffffffff
1 0 0
file C:\Users\test22\AppData\Local\Temp\rcopzfxj.exe
Time & API Arguments Status Return Repeated

LookupPrivilegeValueW

 system_name:
privilege_name: SeDebugPrivilege
1 1 0
Process injection Process 2656 called NtSetContextThread to modify thread in remote process 2732
Time & API Arguments Status Return Repeated

NtSetContextThread

 registers.eip: 1995571652
registers.esp: 1638384
registers.edi: 0
registers.eax: 4199136
registers.ebp: 0
registers.edx: 0
registers.ebx: 2130567168
registers.esi: 0
registers.ecx: 0
thread_handle: 0x000000f4
process_identifier: 2732
1 0 0
MicroWorld-eScan Gen:Variant.Nemesis.1805
FireEye Generic.mg.d826f8c8edb9b4ee
Cynet Malicious (score: 100)
CrowdStrike win/malicious_confidence_100% (D)
K7GW Trojan ( 005a14a01 )
K7AntiVirus Trojan ( 005a14a01 )
Arcabit Trojan.Nemesis.D70D [many]
Symantec Packed.NSISPacker!g14
Elastic malicious (high confidence)
ESET-NOD32 a variant of Win32/Injector.ESUR
APEX Malicious
Kaspersky HEUR:Trojan-Spy.Win32.Noon.gen
BitDefender Gen:Variant.Nemesis.1805
Avast Win32:MalwareX-gen [Trj]
Rising Trojan.Injector!1.E3C9 (CLASSIC)
DrWeb Trojan.MulDrop21.52510
VIPRE Gen:Variant.Nemesis.1805
McAfee-GW-Edition BehavesLike.Win32.Generic.fc
Emsisoft Gen:Variant.Nemesis.1805 (B)
SentinelOne Static AI - Suspicious PE
Avira HEUR/AGEN.1337932
MAX malware (ai score=85)
Microsoft Trojan:Win32/Wacatac.B!ml
GData Gen:Variant.Jaik.124214
Google Detected
ALYac Gen:Variant.Jaik.124214
Ikarus Trojan-Spy.FormBook
Fortinet W32/ShellcodeRunner.CA!tr
AVG Win32:MalwareX-gen [Trj]