Summary | ZeroBOX

Category	Machine	Started	Completed
FILE	s1_win7_x6403_us	April 13, 2023, 6:12 p.m.	April 13, 2023, 6:14 p.m.

Size	499.0KB
Type	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
MD5	`f32b8def722876287f9424f3f3c41d2e`
SHA256	`2ccb90a9fa5b043283533a40fe2e91c7618c5957625ce4328da1746b7bb6a434`
CRC32	`DBDAD598`
ssdeep	`6144:kEr4hfoYGarg5IFnzXu/7+QxDiM5snMvB0EmKLZPDvOBpqgOM0unDb7M:/arg+nE7hf3bvOBpXRg`
Yara	UPX_Zero - UPX packed file Generic_Malware_Zero - Generic Malware OS_Processor_Check_Zero - OS Processor Check Win_Backdoor_njRAT_1_Zero - Win Backdoor njRAT Is_DotNET_EXE - (no description) IsPE32 - (no description) PE_Header_Zero - PE File Signature NorthKorea_Zero - Maybe it's North Korea File

up-do-dat-TRURNfy8CgzSgm9K.exe "C:\Users\test22\AppData\Local\Temp\up-do-dat-TRURNfy8CgzSgm9K.exe"
1952

Name	Response	Post-Analysis Lookup
No hosts contacted.

IP Address	Status	Action
No hosts contacted.

Suricata Alerts

No Suricata Alerts

Suricata TLS

No Suricata TLS

Checks if process is being debugged by a debugger (1 event)

Time & API	Arguments	Status	Return	Repeated
IsDebuggerPresent April 13, 2023, 6:12 p.m.			0	0

Checks amount of memory in system, this can be used to detect virtual machines that have a low amount of memory available (1 event)

Time & API	Arguments	Status	Return	Repeated
GlobalMemoryStatusEx April 13, 2023, 6:12 p.m.		1	1	0

One or more processes crashed (1 event)

Time & API	Arguments	Status	Return	Repeated
__exception__ April 13, 2023, 6:12 p.m.	stacktrace: 0x7ff001602d3 0x7ff00160151 IEE+0xda16 GetUserStore-0xa7e mscorwks+0x2c1612 @ 0x7fef3871612 CreateAssemblyNameObject+0x5cbb CompareAssemblyIdentity-0x6ff9 mscorwks+0x1eee13 @ 0x7fef379ee13 PreBindAssembly+0x79a91 LoadStringRC-0x2544f mscorwks+0x69bc51 @ 0x7fef3c4bc51 GetCLRFunction+0xccaf CreateApplicationContext-0xa211 mscorwks+0x117dc7 @ 0x7fef36c7dc7 StrongNameErrorInfo-0x31f0 mscorwks+0xf4118 @ 0x7fef36a4118 GetAssemblyIdentityFromFile+0x195bd LegacyNGenFreeZapper-0x17af3 mscorwks+0x787e3d @ 0x7fef3d37e3d StrongNameErrorInfo-0x10ded mscorwks+0xe651b @ 0x7fef369651b _CorExeMain+0xac GetCLRFunction-0x72b8 mscorwks+0x103e60 @ 0x7fef36b3e60 _CorExeMain+0x5d CLRCreateInstance-0x2bd3 mscoreei+0x74e5 @ 0x7fef3fd74e5 _CorExeMain+0x69 ND_RU1-0x1707 mscoree+0x5b21 @ 0x7fef4075b21 BaseThreadInitThunk+0xd CreateThread-0x53 kernel32+0x1652d @ 0x76fd652d RtlUserThreadStart+0x21 strchr-0x3df ntdll+0x2c521 @ 0x776ec521 exception.instruction_r: 48 8b 7b 08 48 85 ff 0f 86 50 01 00 00 48 8b 4b exception.instruction: mov rdi, qword ptr [rbx + 8] exception.exception_code: 0xc0000005 exception.symbol: exception.address: 0x7ff001602d3 registers.r14: 0 registers.r15: 0 registers.rcx: 0 registers.rsi: 0 registers.r10: 8796092104728 registers.rbx: 0 registers.rsp: 3538512 registers.r11: 514 registers.r8: 3533312 registers.r9: 0 registers.rdx: 1 registers.r12: 0 registers.rbp: 0 registers.rdi: 0 registers.rax: 0 registers.r13: 0	1	0	0

Time & API

Arguments

Status

Return

Repeated

__exception__

April 13, 2023, 6:12 p.m.

stacktrace:

0x7ff001602d3
0x7ff00160151
IEE+0xda16 GetUserStore-0xa7e mscorwks+0x2c1612 @ 0x7fef3871612
CreateAssemblyNameObject+0x5cbb CompareAssemblyIdentity-0x6ff9 mscorwks+0x1eee13 @ 0x7fef379ee13
PreBindAssembly+0x79a91 LoadStringRC-0x2544f mscorwks+0x69bc51 @ 0x7fef3c4bc51
GetCLRFunction+0xccaf CreateApplicationContext-0xa211 mscorwks+0x117dc7 @ 0x7fef36c7dc7
StrongNameErrorInfo-0x31f0 mscorwks+0xf4118 @ 0x7fef36a4118
GetAssemblyIdentityFromFile+0x195bd LegacyNGenFreeZapper-0x17af3 mscorwks+0x787e3d @ 0x7fef3d37e3d
StrongNameErrorInfo-0x10ded mscorwks+0xe651b @ 0x7fef369651b
_CorExeMain+0xac GetCLRFunction-0x72b8 mscorwks+0x103e60 @ 0x7fef36b3e60
_CorExeMain+0x5d CLRCreateInstance-0x2bd3 mscoreei+0x74e5 @ 0x7fef3fd74e5
_CorExeMain+0x69 ND_RU1-0x1707 mscoree+0x5b21 @ 0x7fef4075b21
BaseThreadInitThunk+0xd CreateThread-0x53 kernel32+0x1652d @ 0x76fd652d
RtlUserThreadStart+0x21 strchr-0x3df ntdll+0x2c521 @ 0x776ec521

exception.instruction_r: 48 8b 7b 08 48 85 ff 0f 86 50 01 00 00 48 8b 4b
exception.instruction: mov rdi, qword ptr [rbx + 8]
exception.exception_code: 0xc0000005
exception.symbol:
exception.address: 0x7ff001602d3
registers.r14: 0
registers.r15: 0
registers.rcx: 0
registers.rsi: 0
registers.r10: 8796092104728
registers.rbx: 0
registers.rsp: 3538512
registers.r11: 514
registers.r8: 3533312
registers.r9: 0
registers.rdx: 1
registers.r12: 0
registers.rbp: 0
registers.rdi: 0
registers.rax: 0
registers.r13: 0

Allocates read-write-execute memory (usually to unpack itself) (38 events)

Time & API	Arguments	Status
NtAllocateVirtualMemory April 13, 2023, 6:12 p.m.	process_identifier: 1952 region_size: 1441792 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0000000000720000 allocation_type: 8192 (MEM_RESERVE) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory April 13, 2023, 6:12 p.m.	process_identifier: 1952 region_size: 8192 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0000000000800000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory April 13, 2023, 6:12 p.m.	process_identifier: 1952 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fef35f1000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory April 13, 2023, 6:12 p.m.	process_identifier: 1952 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fef386e000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory April 13, 2023, 6:12 p.m.	process_identifier: 1952 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fef386e000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory April 13, 2023, 6:12 p.m.	process_identifier: 1952 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fef386f000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory April 13, 2023, 6:12 p.m.	process_identifier: 1952 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fef386f000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory April 13, 2023, 6:12 p.m.	process_identifier: 1952 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fef386f000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory April 13, 2023, 6:12 p.m.	process_identifier: 1952 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fef386f000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory April 13, 2023, 6:12 p.m.	process_identifier: 1952 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fef386f000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory April 13, 2023, 6:12 p.m.	process_identifier: 1952 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fef386f000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory April 13, 2023, 6:12 p.m.	process_identifier: 1952 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fef386f000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory April 13, 2023, 6:12 p.m.	process_identifier: 1952 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fef386f000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory April 13, 2023, 6:12 p.m.	process_identifier: 1952 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fef3870000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory April 13, 2023, 6:12 p.m.	process_identifier: 1952 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fef3870000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory April 13, 2023, 6:12 p.m.	process_identifier: 1952 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fef3870000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory April 13, 2023, 6:12 p.m.	process_identifier: 1952 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fef3870000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory April 13, 2023, 6:12 p.m.	process_identifier: 1952 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fef3870000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory April 13, 2023, 6:12 p.m.	process_identifier: 1952 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fef3871000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory April 13, 2023, 6:12 p.m.	process_identifier: 1952 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fef3871000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory April 13, 2023, 6:12 p.m.	process_identifier: 1952 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fef3871000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory April 13, 2023, 6:12 p.m.	process_identifier: 1952 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fef3871000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory April 13, 2023, 6:12 p.m.	process_identifier: 1952 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fef386e000 process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory April 13, 2023, 6:12 p.m.	process_identifier: 1952 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007ff00022000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory April 13, 2023, 6:12 p.m.	process_identifier: 1952 region_size: 589824 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fffff20000 allocation_type: 1056768 (MEM_RESERVE\|MEM_TOP_DOWN) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory April 13, 2023, 6:12 p.m.	process_identifier: 1952 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fffff20000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory April 13, 2023, 6:12 p.m.	process_identifier: 1952 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fffff20000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory April 13, 2023, 6:12 p.m.	process_identifier: 1952 region_size: 65536 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fffff10000 allocation_type: 1056768 (MEM_RESERVE\|MEM_TOP_DOWN) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory April 13, 2023, 6:12 p.m.	process_identifier: 1952 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fffff10000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory April 13, 2023, 6:12 p.m.	process_identifier: 1952 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007ff000da000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory April 13, 2023, 6:12 p.m.	process_identifier: 1952 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007ff00012000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory April 13, 2023, 6:12 p.m.	process_identifier: 1952 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007ff00023000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory April 13, 2023, 6:12 p.m.	process_identifier: 1952 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007ff000ea000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory April 13, 2023, 6:12 p.m.	process_identifier: 1952 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007ff00112000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory April 13, 2023, 6:12 p.m.	process_identifier: 1952 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007ff000ed000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory April 13, 2023, 6:12 p.m.	process_identifier: 1952 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007ff0002c000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory April 13, 2023, 6:12 p.m.	process_identifier: 1952 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007ff00160000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory April 13, 2023, 6:12 p.m.	process_identifier: 1952 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007ff000db000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1

The binary likely contains encrypted or compressed data indicative of a packer (1 event)

section

{u'size_of_data': u'0x00002600', u'virtual_address': u'0x0007e000', u'entropy': 6.967841894721617, u'name': u'.rsrc', u'virtual_size': u'0x00002558'}

entropy

6.96784189472

description

A section with a high entropy has been found

File has been identified by 49 AntiVirus engines on VirusTotal as malicious (49 events)

Bkav	W32.AIDetectNet.01
Lionic	Trojan.Win32.CSDI.4!c
Elastic	malicious (high confidence)
MicroWorld-eScan	Gen:Variant.Barys.53464
FireEye	Gen:Variant.Barys.53464
ALYac	Gen:Variant.Barys.53464
Cylance	unsafe
Sangfor	Suspicious.Win32.Save.a
CrowdStrike	win/grayware_confidence_90% (W)
Alibaba	TrojanDownloader:MSIL/Wirzemro.0103b12c
K7GW	Adware ( 0056a4511 )
K7AntiVirus	Adware ( 0056a4511 )
BitDefenderTheta	Gen:NN.ZemsilF.36132.Fm0@a8K1Cui
VirIT	Trojan.Win32.MSIL_Heur.A
Cyren	W32/ABRisk.FRPU-3377
Symantec	ML.Attribute.HighConfidence
ESET-NOD32	a variant of MSIL/Adware.CsdiMonetize.BD
Cynet	Malicious (score: 100)
APEX	Malicious
Paloalto	generic.ml
Kaspersky	HEUR:Trojan-Downloader.MSIL.CSDI.gen
BitDefender	Gen:Variant.Barys.53464
Avast	Win32:AdwareX-gen [Adw]
Sophos	Generic Reputation PUA (PUA)
F-Secure	Heuristic.HEUR/AGEN.1310193
DrWeb	Adware.WizzMonetize.1
VIPRE	Gen:Variant.Barys.53464
McAfee-GW-Edition	Artemis!PUP
Trapmine	suspicious.low.ml.score
Emsisoft	Gen:Variant.Barys.53464 (B)
SentinelOne	Static AI - Malicious PE
Avira	HEUR/AGEN.1310193
Antiy-AVL	GrayWare[AdWare]/MSIL.CsdiMonetize
Gridinsoft	Adware.Win32.Downloader.sa
Arcabit	Trojan.Barys.DD0D8
ZoneAlarm	HEUR:Trojan-Downloader.MSIL.CSDI.gen
GData	Gen:Variant.Barys.53464
Google	Detected
AhnLab-V3	Trojan/Win.Wirzemro.C5407654
McAfee	Artemis!F32B8DEF7228
MAX	malware (ai score=88)
Malwarebytes	CsdiMonetize.Adware.Bundler.DDS
Panda	Trj/GdSda.A
TrendMicro-HouseCall	TROJ_GEN.R002C0DD823
Tencent	Msil.Trojan-Downloader.Csdi.Twhl
Ikarus	AdWare.MSIL.Csdimonetize
Fortinet	Adware/CsdiMonetize
AVG	Win32:AdwareX-gen [Adw]
DeepInstinct	MALICIOUS

up-do-dat-TRURNfy8CgzSgm9K.exe

Process Tree Toggle all

Network Toggle all

Suricata Toggle all

Suricata Alerts

Suricata TLS

Signatures Toggle All