popup
Summary | ZeroBOX
  1. Home
  2. Result
  3. Report
  4. Detail Analysis

newamka2.1.exe

NSIS UPX Malicious Library PE File DLL OS Processor Check PE32
  1. Resubmit sample
Category Machine Started Completed
FILE s1_win7_x6401 May 25, 2023, 5:35 p.m. May 25, 2023, 5:48 p.m.
Size 163.6KB
Type PE32 executable (GUI) Intel 80386, for MS Windows, Nullsoft Installer self-extracting archive
MD5 21ffcbf147759f82745f07bfdb0662f4
SHA256 ddcb13f6db4575ad1983794aa82529e5c21ce34823c0270801f8ab9543b1ffba
CRC32 E03AE9E9
ssdeep 3072:cfY/TU9fE9PEtu+b+MXjULoSsr8cikLhzifVKCuzNGPL+xi0iCMy5GqG:KYa6a+M4Mh5iwmOHtLdG
Yara
  • UPX_Zero - UPX packed file
  • Malicious_Library_Zero - Malicious_Library
  • NSIS_Installer - Null Soft Installer
  • PE_Header_Zero - PE File Signature
  • IsPE32 - (no description)

Name Response Post-Analysis Lookup
instac.duckdns.org
A 77.220.215.70
77.220.215.70
IP Address Status Action
164.124.101.2 Active Moloch
77.220.215.70 Active Moloch
37.230.138.123 Active Moloch
37.230.138.66 Active Moloch
5.75.210.95 Active Moloch

Time & API Arguments Status Return Repeated

GetComputerNameW

 computer_name: TEST22-PC
1 1 0
registry HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\MachineGuid
Time & API Arguments Status Return Repeated

GlobalMemoryStatusEx

 1 1 0
section .ndata
domain instac.duckdns.org
Time & API Arguments Status Return Repeated

NtProtectVirtualMemory

 process_identifier: 2560
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x73312000
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2560
region_size: 8192
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x031c0000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2560
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x031d0000
allocation_type: 12289 (MEM_COMMIT|MEM_RESERVE)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 1452
region_size: 65536
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x0000000004160000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffffffffffff
1 0 0
file C:\Users\test22\AppData\Local\Temp\nshF00F.tmp\rtouejuajl.dll
file C:\Users\test22\AppData\Roaming\jscxhqmv\rbkgpyueajs.exe
file C:\Users\test22\AppData\Local\Temp\nshF00F.tmp\rtouejuajl.dll
file C:\Users\test22\AppData\Roaming\jscxhqmv\rbkgpyueajs.exe
host 37.230.138.123
host 37.230.138.66
host 5.75.210.95
reg_key HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run\nwgclhqavf reg_value C:\Users\test22\AppData\Roaming\jscxhqmv\rbkgpyueajs.exe "C:\Users\test22\AppData\Local\Temp\newamka2.1.exe"
Time & API Arguments Status Return Repeated

SetWindowsHookExA

 thread_identifier: 0
callback_function: 0x004074c0
hook_identifier: 13 (WH_KEYBOARD_LL)
module_address: 0x00400000
1 1311121 0
Process injection Process 2560 called NtSetContextThread to modify thread in remote process 2648
Time & API Arguments Status Return Repeated

NtSetContextThread

 registers.eip: 1995571652
registers.esp: 1638384
registers.edi: 0
registers.eax: 4216632
registers.ebp: 0
registers.edx: 0
registers.ebx: 2130567168
registers.esi: 0
registers.ecx: 0
thread_handle: 0x00000228
process_identifier: 2648
1 0 0
Bkav W32.AIDetectMalware
Lionic Trojan.Win32.Agent.tshg
MicroWorld-eScan Gen:Variant.Nemesis.22779
Cylance unsafe
VIPRE Gen:Variant.Nemesis.22779
Sangfor Trojan.Win32.Injector.Vsjj
Cybereason malicious.147759
Arcabit Trojan.Nemesis.D58FB [many]
Cyren W32/Injector.BNH.gen!Eldorado
Symantec ML.Attribute.HighConfidence
Elastic malicious (high confidence)
ESET-NOD32 a variant of Win32/Injector.ESZC
Cynet Malicious (score: 100)
APEX Malicious
Kaspersky UDS:DangerousObject.Multi.Generic
BitDefender Gen:Variant.Nemesis.22779
Avast FileRepMalware [Rat]
Emsisoft Gen:Variant.Nemesis.22779 (B)
McAfee-GW-Edition BehavesLike.Win32.Generic.cc
FireEye Generic.mg.21ffcbf147759f82
Ikarus Trojan.NSIS.Agent
Gridinsoft Trojan.Win32.WarzoneRAT.bot
Microsoft Backdoor:Win32/Remcos!MTB
ZoneAlarm UDS:DangerousObject.Multi.Generic
GData Zum.Androm.1
Google Detected
AhnLab-V3 Trojan/Win.NSISInject.R495658
Acronis suspicious
McAfee Artemis!21FFCBF14775
MAX malware (ai score=85)
Malwarebytes Generic.Malware/Suspicious
Rising Trojan.Generic@AI.89 (RDML:0zSRA9QLPe/+3bvyeyQi9Q)
SentinelOne Static AI - Suspicious PE
Fortinet W32/Injector.ESYW!tr
AVG FileRepMalware [Rat]
DeepInstinct MALICIOUS
CrowdStrike win/malicious_confidence_100% (D)