Summary | ZeroBOX

Category	Machine	Started	Completed
FILE	s1_win7_x6403_us	March 23, 2023, 6:22 p.m.	March 23, 2023, 6:28 p.m.

Size	33.0KB
Type	PE32 executable (console) Intel 80386 Mono/.Net assembly, for MS Windows
MD5	`ce43d05a16369e03f1ee9e997bce44f6`
SHA256	`e8734f6ab6ba0ad51c2a517b8e03b57819a3cce7e6016374917b9fefe3fd3ec1`
CRC32	`7B25C3FE`
ssdeep	`384:CWMrc296pyUj4mC9k/Gs98e/YdfsO5wCZimFIIYXh6fa81pDh5LEq2TBPSmrzRl8:CWqX96WcCv9s5hFh6r5L6TB1zRlBE8C`
Yara	UPX_Zero - UPX packed file Is_DotNET_EXE - (no description) Malicious_Packer_Zero - Malicious Packer Win_Backdoor_AsyncRAT_Zero - Win Backdoor AsyncRAT IsPE32 - (no description) PE_Header_Zero - PE File Signature Antivirus - Contains references to security software

ConPtyShell.exe "C:\Users\test22\AppData\Local\Temp\ConPtyShell.exe"
1704

Name	Response	Post-Analysis Lookup
No hosts contacted.

IP Address	Status	Action
3.125.102.39	Active	Moloch

Suricata Alerts

No Suricata Alerts

Suricata TLS

No Suricata TLS

Checks if process is being debugged by a debugger (2 events)

Time & API	Arguments	Status	Return	Repeated
IsDebuggerPresent March 23, 2023, 6:15 p.m.			0	0
IsDebuggerPresent March 23, 2023, 6:15 p.m.			0	0

Checks amount of memory in system, this can be used to detect virtual machines that have a low amount of memory available (1 event)

Time & API	Arguments	Status	Return	Repeated
GlobalMemoryStatusEx March 23, 2023, 6:15 p.m.		1	1	0

Allocates read-write-execute memory (usually to unpack itself) (34 events)

Time & API	Arguments	Status
NtAllocateVirtualMemory March 23, 2023, 6:15 p.m.	process_identifier: 1704 region_size: 1900544 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0000000000770000 allocation_type: 8192 (MEM_RESERVE) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory March 23, 2023, 6:15 p.m.	process_identifier: 1704 region_size: 8192 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00000000008c0000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory March 23, 2023, 6:15 p.m.	process_identifier: 1704 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fef3641000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory March 23, 2023, 6:15 p.m.	process_identifier: 1704 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fef3cdb000 process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory March 23, 2023, 6:15 p.m.	process_identifier: 1704 region_size: 1507328 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0000000000c60000 allocation_type: 8192 (MEM_RESERVE) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory March 23, 2023, 6:15 p.m.	process_identifier: 1704 region_size: 8192 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0000000000d50000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory March 23, 2023, 6:15 p.m.	process_identifier: 1704 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fef3642000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory March 23, 2023, 6:15 p.m.	process_identifier: 1704 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fef3642000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory March 23, 2023, 6:15 p.m.	process_identifier: 1704 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fef3642000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory March 23, 2023, 6:15 p.m.	process_identifier: 1704 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fef3642000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory March 23, 2023, 6:15 p.m.	process_identifier: 1704 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fef3642000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory March 23, 2023, 6:15 p.m.	process_identifier: 1704 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fef3642000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory March 23, 2023, 6:15 p.m.	process_identifier: 1704 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fef3642000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory March 23, 2023, 6:15 p.m.	process_identifier: 1704 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fef3642000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory March 23, 2023, 6:15 p.m.	process_identifier: 1704 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fef3642000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory March 23, 2023, 6:15 p.m.	process_identifier: 1704 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fef3642000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory March 23, 2023, 6:15 p.m.	process_identifier: 1704 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fef3642000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory March 23, 2023, 6:15 p.m.	process_identifier: 1704 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fef3644000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory March 23, 2023, 6:15 p.m.	process_identifier: 1704 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fef3644000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory March 23, 2023, 6:15 p.m.	process_identifier: 1704 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fef3644000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory March 23, 2023, 6:15 p.m.	process_identifier: 1704 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fef3644000 process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory March 23, 2023, 6:15 p.m.	process_identifier: 1704 region_size: 655360 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fffff10000 allocation_type: 1056768 (MEM_RESERVE\|MEM_TOP_DOWN) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory March 23, 2023, 6:15 p.m.	process_identifier: 1704 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fffff10000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory March 23, 2023, 6:15 p.m.	process_identifier: 1704 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fffff10000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory March 23, 2023, 6:15 p.m.	process_identifier: 1704 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fffff20000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory March 23, 2023, 6:15 p.m.	process_identifier: 1704 region_size: 65536 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fffff00000 allocation_type: 1056768 (MEM_RESERVE\|MEM_TOP_DOWN) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory March 23, 2023, 6:15 p.m.	process_identifier: 1704 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fffff00000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory March 23, 2023, 6:15 p.m.	process_identifier: 1704 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fe93eca000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory March 23, 2023, 6:15 p.m.	process_identifier: 1704 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fe93f7c000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory March 23, 2023, 6:15 p.m.	process_identifier: 1704 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fe93fa6000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory March 23, 2023, 6:15 p.m.	process_identifier: 1704 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fe93f80000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory March 23, 2023, 6:15 p.m.	process_identifier: 1704 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fe93edc000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory March 23, 2023, 6:15 p.m.	process_identifier: 1704 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fe93ff0000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory March 23, 2023, 6:15 p.m.	process_identifier: 1704 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fe93ecb000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1

Communicates with host for which no DNS query was performed (1 event)

host

3.125.102.39

File has been identified by 36 AntiVirus engines on VirusTotal as malicious (36 events)

Bkav	W32.AIDetectNet.01
Lionic	Trojan.Win32.Zilla.4!c
MicroWorld-eScan	IL:Trojan.MSILZilla.13357
FireEye	IL:Trojan.MSILZilla.13357
McAfee	RDN/Generic PUP.z
Malwarebytes	Malware.AI.2344353852
Sangfor	Hacktool.Msil.Darius.Voq4
CrowdStrike	win/malicious_confidence_60% (W)
Alibaba	HackTool:MSIL/Darius.d1958037
Arcabit	IL:Trojan.MSILZilla.D342D
Symantec	ML.Attribute.HighConfidence
Elastic	malicious (high confidence)
ESET-NOD32	a variant of MSIL/Agent_AGen.AQA
Cynet	Malicious (score: 100)
APEX	Malicious
BitDefender	IL:Trojan.MSILZilla.13357
Avast	Win32:HacktoolX-gen [Trj]
VIPRE	IL:Trojan.MSILZilla.13357
TrendMicro	TROJ_GEN.R03BC0PBO23
McAfee-GW-Edition	RDN/Generic PUP.z
Trapmine	malicious.moderate.ml.score
Emsisoft	IL:Trojan.MSILZilla.13357 (B)
SentinelOne	Static AI - Suspicious PE
Antiy-AVL	HackTool/MSIL.Darius
Xcitium	ApplicUnwnt@#1rtz3wxibqgkp
Microsoft	HackTool:MSIL/Darius.A!MTB
GData	IL:Trojan.MSILZilla.13357
Google	Detected
MAX	malware (ai score=84)
TrendMicro-HouseCall	TROJ_GEN.R03BC0PBO23
Rising	HackTool.Darius!8.11BA8 (CLOUD)
Ikarus	Trojan.MSIL.Agent
MaxSecure	Trojan.Malware.192694109.susgen
Fortinet	PossibleThreat
AVG	Win32:HacktoolX-gen [Trj]
Panda	Trj/GdSda.A

ConPtyShell.exe

Process Tree Toggle all

Network Toggle all

Suricata Toggle all

Suricata Alerts

Suricata TLS

Signatures Toggle All