Summary | ZeroBOX

Category	Machine	Started	Completed
FILE	s1_win7_x6401	May 23, 2023, 5:13 p.m.	May 23, 2023, 5:21 p.m.

Size	112.0KB
Type	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
MD5	`24781c1e54454da853bef89a12b65975`
SHA256	`7f0298fe79b3d4ea8293eceac1555ee8abeabbfca24d39fac5447ac0e1448c33`
CRC32	`2EDB5474`
ssdeep	`3072:S1HEqBlf7xpQgWqpbE8K2I/ojRR6o55G5+8uHFbN:AHEqBlfVpQgWgbE8KMn6o55G5+XN`
Yara	Is_DotNET_EXE - (no description) Win_Backdoor_AsyncRAT_Zero - Win Backdoor AsyncRAT PE_Header_Zero - PE File Signature IsPE32 - (no description)

Zhazpwadddz.exe "C:\Users\test22\AppData\Local\Temp\Zhazpwadddz.exe"
2548

Name	Response	Post-Analysis Lookup
No hosts contacted.

IP Address	Status	Action
No hosts contacted.

Suricata Alerts

No Suricata Alerts

Suricata TLS

No Suricata TLS

Checks if process is being debugged by a debugger (50 out of 240 events)

Time & API	Arguments	Status	Return	Repeated
IsDebuggerPresent May 23, 2023, 5:13 p.m.			0	0
IsDebuggerPresent May 23, 2023, 5:13 p.m.			0	0
IsDebuggerPresent May 23, 2023, 5:13 p.m.			0	0
IsDebuggerPresent May 23, 2023, 5:13 p.m.			0	0
IsDebuggerPresent May 23, 2023, 5:13 p.m.			0	0
IsDebuggerPresent May 23, 2023, 5:13 p.m.			0	0
IsDebuggerPresent May 23, 2023, 5:13 p.m.			0	0
IsDebuggerPresent May 23, 2023, 5:13 p.m.			0	0
IsDebuggerPresent May 23, 2023, 5:13 p.m.			0	0
IsDebuggerPresent May 23, 2023, 5:13 p.m.			0	0
IsDebuggerPresent May 23, 2023, 5:13 p.m.			0	0
IsDebuggerPresent May 23, 2023, 5:13 p.m.			0	0
IsDebuggerPresent May 23, 2023, 5:13 p.m.			0	0
IsDebuggerPresent May 23, 2023, 5:13 p.m.			0	0
IsDebuggerPresent May 23, 2023, 5:13 p.m.			0	0
IsDebuggerPresent May 23, 2023, 5:13 p.m.			0	0
IsDebuggerPresent May 23, 2023, 5:13 p.m.			0	0
IsDebuggerPresent May 23, 2023, 5:13 p.m.			0	0
IsDebuggerPresent May 23, 2023, 5:13 p.m.			0	0
IsDebuggerPresent May 23, 2023, 5:13 p.m.			0	0
IsDebuggerPresent May 23, 2023, 5:13 p.m.			0	0
IsDebuggerPresent May 23, 2023, 5:13 p.m.			0	0
IsDebuggerPresent May 23, 2023, 5:13 p.m.			0	0
IsDebuggerPresent May 23, 2023, 5:13 p.m.			0	0
IsDebuggerPresent May 23, 2023, 5:13 p.m.			0	0
IsDebuggerPresent May 23, 2023, 5:13 p.m.			0	0
IsDebuggerPresent May 23, 2023, 5:13 p.m.			0	0
IsDebuggerPresent May 23, 2023, 5:13 p.m.			0	0
IsDebuggerPresent May 23, 2023, 5:13 p.m.			0	0
IsDebuggerPresent May 23, 2023, 5:13 p.m.			0	0
IsDebuggerPresent May 23, 2023, 5:14 p.m.			0	0
IsDebuggerPresent May 23, 2023, 5:14 p.m.			0	0
IsDebuggerPresent May 23, 2023, 5:14 p.m.			0	0
IsDebuggerPresent May 23, 2023, 5:14 p.m.			0	0
IsDebuggerPresent May 23, 2023, 5:14 p.m.			0	0
IsDebuggerPresent May 23, 2023, 5:14 p.m.			0	0
IsDebuggerPresent May 23, 2023, 5:14 p.m.			0	0
IsDebuggerPresent May 23, 2023, 5:14 p.m.			0	0
IsDebuggerPresent May 23, 2023, 5:14 p.m.			0	0
IsDebuggerPresent May 23, 2023, 5:14 p.m.			0	0
IsDebuggerPresent May 23, 2023, 5:14 p.m.			0	0
IsDebuggerPresent May 23, 2023, 5:14 p.m.			0	0
IsDebuggerPresent May 23, 2023, 5:14 p.m.			0	0
IsDebuggerPresent May 23, 2023, 5:14 p.m.			0	0
IsDebuggerPresent May 23, 2023, 5:14 p.m.			0	0
IsDebuggerPresent May 23, 2023, 5:14 p.m.			0	0
IsDebuggerPresent May 23, 2023, 5:14 p.m.			0	0
IsDebuggerPresent May 23, 2023, 5:14 p.m.			0	0
IsDebuggerPresent May 23, 2023, 5:14 p.m.			0	0
IsDebuggerPresent May 23, 2023, 5:14 p.m.			0	0

Checks amount of memory in system, this can be used to detect virtual machines that have a low amount of memory available (1 event)

Time & API	Arguments	Status	Return	Repeated
GlobalMemoryStatusEx May 23, 2023, 5:13 p.m.		1	1	0

Allocates read-write-execute memory (usually to unpack itself) (30 events)

Time & API	Arguments	Status
NtAllocateVirtualMemory May 23, 2023, 5:13 p.m.	process_identifier: 2548 region_size: 1441792 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00660000 allocation_type: 8192 (MEM_RESERVE) process_handle: 0xffffffff	1
NtAllocateVirtualMemory May 23, 2023, 5:13 p.m.	process_identifier: 2548 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00780000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtProtectVirtualMemory May 23, 2023, 5:13 p.m.	process_identifier: 2548 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x727a1000 process_handle: 0xffffffff	1
NtProtectVirtualMemory May 23, 2023, 5:13 p.m.	process_identifier: 2548 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x727a2000 process_handle: 0xffffffff	1
NtAllocateVirtualMemory May 23, 2023, 5:13 p.m.	process_identifier: 2548 region_size: 1572864 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x02260000 allocation_type: 8192 (MEM_RESERVE) process_handle: 0xffffffff	1
NtAllocateVirtualMemory May 23, 2023, 5:13 p.m.	process_identifier: 2548 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x023a0000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory May 23, 2023, 5:13 p.m.	process_identifier: 2548 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x002a2000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory May 23, 2023, 5:13 p.m.	process_identifier: 2548 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x002bc000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory May 23, 2023, 5:13 p.m.	process_identifier: 2548 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x004f0000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory May 23, 2023, 5:13 p.m.	process_identifier: 2548 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x002aa000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory May 23, 2023, 5:13 p.m.	process_identifier: 2548 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x002d5000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory May 23, 2023, 5:13 p.m.	process_identifier: 2548 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x002db000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory May 23, 2023, 5:13 p.m.	process_identifier: 2548 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x002d7000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory May 23, 2023, 5:13 p.m.	process_identifier: 2548 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x004f1000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory May 23, 2023, 5:13 p.m.	process_identifier: 2548 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x002ca000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory May 23, 2023, 5:13 p.m.	process_identifier: 2548 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x002c7000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory May 23, 2023, 5:13 p.m.	process_identifier: 2548 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x002ba000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory May 23, 2023, 5:13 p.m.	process_identifier: 2548 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x004f2000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory May 23, 2023, 5:13 p.m.	process_identifier: 2548 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0076f000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory May 23, 2023, 5:13 p.m.	process_identifier: 2548 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00760000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory May 23, 2023, 5:13 p.m.	process_identifier: 2548 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x004f3000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory May 23, 2023, 5:13 p.m.	process_identifier: 2548 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x002c6000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory May 23, 2023, 5:13 p.m.	process_identifier: 2548 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x004f4000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory May 23, 2023, 5:13 p.m.	process_identifier: 2548 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x004f5000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory May 23, 2023, 5:13 p.m.	process_identifier: 2548 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x004f6000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory May 23, 2023, 5:13 p.m.	process_identifier: 2548 region_size: 8192 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x004f7000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtProtectVirtualMemory May 23, 2023, 5:13 p.m.	process_identifier: 2548 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x73252000 process_handle: 0xffffffff	1
NtAllocateVirtualMemory May 23, 2023, 5:13 p.m.	process_identifier: 2548 region_size: 16384 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00781000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory May 23, 2023, 5:13 p.m.	process_identifier: 2548 region_size: 69632 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00785000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory May 23, 2023, 5:13 p.m.	process_identifier: 2548 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00796000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1

Checks for the Locally Unique Identifier on the system for a suspicious privilege (1 event)

Time & API	Arguments	Status	Return	Repeated
LookupPrivilegeValueW May 23, 2023, 5:13 p.m.	system_name: privilege_name: SeDebugPrivilege	1	1	0

File has been identified by 24 AntiVirus engines on VirusTotal as malicious (24 events)

Elastic	malicious (high confidence)
FireEye	Generic.mg.24781c1e54454da8
Alibaba	Trojan:MSIL/Generic.b8ee478c
CrowdStrike	win/malicious_confidence_70% (W)
Symantec	ML.Attribute.HighConfidence
ESET-NOD32	a variant of MSIL/TrojanDownloader.Agent.OXE
APEX	Malicious
Kaspersky	UDS:DangerousObject.Multi.Generic
Avast	FileRepMalware [Misc]
Rising	Downloader.Agent!8.B23 (CLOUD)
TrendMicro	Trojan.Win32.AMADEY.YXDEWZ
McAfee-GW-Edition	Artemis!Trojan
Sophos	Mal/Generic-S
Ikarus	Win32.Outbreak
Microsoft	Trojan:Win32/Casdet!rfn
ZoneAlarm	UDS:DangerousObject.Multi.Generic
McAfee	Artemis!24781C1E5445
VBA32	CIL.HeapOverride.Heur
Tencent	Msil.Trojan-Downloader.Ader.Cujl
MaxSecure	Downloader.W32.Upatre.jdyn_228553
BitDefenderTheta	Gen:NN.ZemsilF.36196.hm2@ayh8imaI
AVG	FileRepMalware [Misc]
Cybereason	malicious.92f28b
DeepInstinct	MALICIOUS

Zhazpwadddz.exe

Process Tree Toggle all

Network Toggle all

Suricata Toggle all

Suricata Alerts

Suricata TLS

Signatures Toggle All