popup
Summary | ZeroBOX
  1. Home
  2. Result
  3. Report
  4. Detail Analysis

contrem2.1.exe

Malicious Library UPX OS Processor Check PE32 PE File
  1. Resubmit sample
Category Machine Started Completed
FILE s1_win7_x6403_us April 19, 2023, 8:59 a.m. April 19, 2023, 9:05 a.m.
Size 534.9KB
Type PE32 executable (GUI) Intel 80386, for MS Windows, Nullsoft Installer self-extracting archive
MD5 08186cde92790a745f1e6fbf706fc800
SHA256 affea1453f9f47d6001811fd802e604e46fe94ecdb32da84ca21a3ed5db9b308
CRC32 057AB9E0
ssdeep 12288:gYLPT//O1jIugNmGwddIqFIIaYYXtdVgcyAU8VkSQ/:gYL7//ngGwd8YyzV/yJ8a
Yara
  • UPX_Zero - UPX packed file
  • IsPE32 - (no description)
  • PE_Header_Zero - PE File Signature
  • Malicious_Library_Zero - Malicious_Library

Name Response Post-Analysis Lookup
katruda.duckdns.org
A 212.8.244.201
212.8.244.201
geoplugin.net
A 178.237.33.50
178.237.33.50
IP Address Status Action
164.124.101.2 Active Moloch
178.237.33.50 Active Moloch
212.8.244.201 Active Moloch

Suricata Alerts

Flow SID Signature Category
UDP 192.168.56.103:52760 -> 164.124.101.2:53 2042936 ET INFO DYNAMIC_DNS Query to a *.duckdns .org Domain Potentially Bad Traffic
UDP 192.168.56.103:52760 -> 164.124.101.2:53 2022918 ET INFO DYNAMIC_DNS Query to *.duckdns. Domain Misc activity
TCP 192.168.56.103:49165 -> 212.8.244.201:1992 2036594 ET JA3 Hash - Remcos 3.x TLS Connection Malware Command and Control Activity Detected

Suricata TLS

Flow Issuer Subject Fingerprint
TLS 1.3
192.168.56.103:49165
212.8.244.201:1992 		None None None

Time & API Arguments Status Return Repeated

IsDebuggerPresent

 0 0
Time & API Arguments Status Return Repeated

WriteConsoleA

 buffer: Remcos v4.5.0 Pro © BreakingSecurity.net
console_handle: 0x0000000f
1 1 0

WriteConsoleA

 buffer: 16:19:32:375 i | Remcos Agent initialized
console_handle: 0x0000000f
1 1 0

WriteConsoleA

 buffer: 16:19:32:375 i | Access Level: Administrator
console_handle: 0x0000000f
1 1 0

WriteConsoleA

 buffer: 16:19:32:390 i | Connecting | TLS On | katruda.duckdns.org:1992
console_handle: 0x0000000f
1 1 0

WriteConsoleA

 buffer: 16:19:32:937 i | TLS Handshake... | katruda.duckdns.org:1992
console_handle: 0x0000000f
1 1 0

WriteConsoleA

 buffer: 16:19:33:750 i | Connected | TLS On | katruda.duckdns.org:1992
console_handle: 0x0000000f
1 1 0

WriteConsoleA

 buffer: 16:19:34:703 i | KeepAlive | Enabled | Timeout: 60
console_handle: 0x0000000f
1 1 0
Time & API Arguments Status Return Repeated

GlobalMemoryStatusEx

 1 1 0
section .ndata
suspicious_features GET method with no useragent header suspicious_request GET http://geoplugin.net/json.gp
domain katruda.duckdns.org
request GET http://geoplugin.net/json.gp
Time & API Arguments Status Return Repeated

NtAllocateVirtualMemory

 process_identifier: 2052
region_size: 8192
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x01d90000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2052
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x01da0000
allocation_type: 12289 (MEM_COMMIT|MEM_RESERVE)
process_handle: 0xffffffff
1 0 0
file C:\Users\test22\AppData\Local\Temp\fkfoiuttz.exe
file C:\Users\test22\AppData\Roaming\mrbwgcluq\ajfo.exe
file C:\Users\test22\AppData\Roaming\mrbwgcluq\ajfo.exe
reg_key HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run\ktdyiqmv reg_value C:\Users\test22\AppData\Roaming\mrbwgcluq\ajfo.exe "C:\Users\test22\AppData\Local\Temp\fkfoiuttz.exe" C:\Users\test22\AppData\Loc
Process injection Process 2052 called NtSetContextThread to modify thread in remote process 2108
Time & API Arguments Status Return Repeated

NtSetContextThread

 registers.eip: 2005598660
registers.esp: 1638384
registers.edi: 0
registers.eax: 4403648
registers.ebp: 0
registers.edx: 0
registers.ebx: 2130567168
registers.esi: 0
registers.ecx: 0
thread_handle: 0x000000e4
process_identifier: 2108
1 0 0
MicroWorld-eScan Trojan.NSISX.Spy.Gen.24
Cylance unsafe
VIPRE Trojan.NSISX.Spy.Gen.24
CrowdStrike win/malicious_confidence_100% (D)
Symantec Packed.NSISPacker!g14
Elastic malicious (high confidence)
ESET-NOD32 a variant of Win32/Injector.ESWJ
Cynet Malicious (score: 100)
APEX Malicious
Paloalto generic.ml
Kaspersky UDS:DangerousObject.Multi.Generic
BitDefender Trojan.NSISX.Spy.Gen.24
Avast FileRepMalware [Trj]
Emsisoft Trojan.NSISX.Spy.Gen.24 (B)
F-Secure Heuristic.HEUR/AGEN.1337959
McAfee-GW-Edition BehavesLike.Win32.Generic.hc
FireEye Generic.mg.08186cde92790a74
Ikarus Trojan.Inject
GData Gen:Variant.Fragtor.261666
Avira HEUR/AGEN.1337959
Arcabit Trojan.NSISX.Spy.Gen.24 [many]
ZoneAlarm UDS:DangerousObject.Multi.Generic
Microsoft Trojan:Win32/Wacatac.B!ml
Google Detected
AhnLab-V3 Infostealer/Win.Generic.C5395778
BitDefenderTheta Gen:NN.ZexaF.36164.fqW@aifATUei
ALYac Trojan.NSISX.Spy.Gen.24
MAX malware (ai score=88)
VBA32 BScope.Trojan.Wacatac
Rising Trojan.Generic@AI.82 (RDML:/3Im4WAK1PbqvK62hAjzUg)
Fortinet W32/Injector.ESWG!tr
AVG FileRepMalware [Trj]
DeepInstinct MALICIOUS