popup
Summary | ZeroBOX
  1. Home
  2. Result
  3. Report
  4. Detail Analysis

swiss.exe

NSIS UPX Malicious Library PE File DLL OS Processor Check PE32
  1. Resubmit sample
Category Machine Started Completed
FILE s1_win7_x6403_us May 26, 2023, 6:16 p.m. May 26, 2023, 6:18 p.m.
Size 166.4KB
Type PE32 executable (GUI) Intel 80386, for MS Windows, Nullsoft Installer self-extracting archive
MD5 9e57567ee21222fa361798821a9571aa
SHA256 cbb4651ae079249803e66087adfc5c3aca166a5f3147937069c290bdfb3b181f
CRC32 9F2D499F
ssdeep 3072:zfY/TU9fE9PEtuPbC6I8xPFSxDEJvhkYO/aXeJ/Q1cNJpn1UIDPJ:DYa61KQ92DshkYiJ/Q141UI
Yara
  • UPX_Zero - UPX packed file
  • Malicious_Library_Zero - Malicious_Library
  • NSIS_Installer - Null Soft Installer
  • PE_Header_Zero - PE File Signature
  • IsPE32 - (no description)

Name Response Post-Analysis Lookup
osairus.duckdns.org
A 185.92.149.180
185.92.149.180
www.google.com
A 172.217.25.4
142.250.206.228
IP Address Status Action
164.124.101.2 Active Moloch
172.217.25.4 Active Moloch
185.92.149.180 Active Moloch
5.206.225.104 Active Moloch

Time & API Arguments Status Return Repeated

GetComputerNameW

 computer_name: TEST22-PC
1 1 0

GetComputerNameA

 computer_name: TEST22-PC
1 1 0
registry HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\MachineGuid
file C:\Program Files\Mozilla Firefox\firefox.exe
registry HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\App Paths\firefox.exe
Time & API Arguments Status Return Repeated

GlobalMemoryStatusEx

 1 1 0
section .ndata
domain osairus.duckdns.org
Time & API Arguments Status Return Repeated

NtAllocateVirtualMemory

 process_identifier: 1664
region_size: 8192
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x02d40000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 1664
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x02d90000
allocation_type: 12289 (MEM_COMMIT|MEM_RESERVE)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2128
region_size: 540672
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x02e80000
allocation_type: 12288 (MEM_COMMIT|MEM_RESERVE)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 1236
region_size: 65536
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x0000000006500000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffffffffffff
1 0 0
Time & API Arguments Status Return Repeated

GetDiskFreeSpaceW

 number_of_free_clusters: 8362495
sectors_per_cluster: 8362495
bytes_per_sector: 512
root_path: C:
total_number_of_clusters: 8362495
1 1 0

GetDiskFreeSpaceW

 number_of_free_clusters: 2425628
sectors_per_cluster: 8
bytes_per_sector: 512
root_path: \
total_number_of_clusters: 8362495
1 1 0
file C:\Users\test22\AppData\Local\Google\Chrome\User Data\Default\Login Data
file C:\Users\test22\AppData\Roaming\rwgclhqauen\jsoxhdmv.exe
file C:\Users\test22\AppData\Local\Temp\nsfBEA9.tmp\ohpic.dll
file C:\Users\test22\AppData\Roaming\rwgclhqauen\jsoxhdmv.exe
file C:\Users\test22\AppData\Local\Temp\nsfBEA9.tmp\ohpic.dll
host 5.206.225.104
reg_key HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run\rbwgplueyie reg_value C:\Users\test22\AppData\Roaming\rwgclhqauen\jsoxhdmv.exe "C:\Users\test22\AppData\Local\Temp\swiss.exe"
Time & API Arguments Status Return Repeated

RegSetValueExA

 key_handle: 0x0000032c
regkey_r: ProxyEnable
reg_type: 4 (REG_DWORD)
value: 0
regkey: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ProxyEnable
1 0 0
file C:\Users\test22\AppData\Roaming\Thunderbird\profiles.ini
registry HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\00000003
process swiss.exe useragent Internal
process swiss.exe useragent Mozilla/32.0 (compatible)
Process injection Process 1664 called NtSetContextThread to modify thread in remote process 2128
Time & API Arguments Status Return Repeated

NtSetContextThread

 registers.eip: 2005598660
registers.esp: 1638384
registers.edi: 0
registers.eax: 4216632
registers.ebp: 0
registers.edx: 0
registers.ebx: 2130567168
registers.esi: 0
registers.ecx: 0
thread_handle: 0x00000224
process_identifier: 2128
1 0 0
dead_host 5.206.225.104:80
Bkav W32.AIDetectMalware
Lionic Trojan.Win32.Agent.tshg
Elastic malicious (high confidence)
Cynet Malicious (score: 100)
Sangfor Trojan.Win32.Agent.V3nt
BitDefender Gen:Variant.Nemesis.23707
Cybereason malicious.ee2122
BitDefenderTheta Gen:NN.ZedlaF.36196.cm4@a8d5xZh
Cyren W32/Injector.BNK.gen!Eldorado
Symantec ML.Attribute.HighConfidence
ESET-NOD32 a variant of Win32/Injector.ESZC
APEX Malicious
Kaspersky UDS:DangerousObject.Multi.Generic
MicroWorld-eScan Gen:Variant.Nemesis.23707
Avast Win32:PWSX-gen [Trj]
Rising Trojan.Generic@AI.97 (RDML:xghvi8ltjiHeN1QK9epSGQ)
Emsisoft Gen:Variant.Nemesis.23707 (B)
VIPRE Trojan.NSISX.Spy.Gen.24
McAfee-GW-Edition BehavesLike.Win32.Generic.cc
Trapmine malicious.moderate.ml.score
FireEye Generic.mg.9e57567ee21222fa
Sophos Generic ML PUA (PUA)
Ikarus Trojan.NSIS.Agent
GData Zum.Androm.1
Arcabit Trojan.Nemesis.D5C9B [many]
ZoneAlarm UDS:DangerousObject.Multi.Generic
Microsoft Trojan:Win32/Sabsik.FL.B!ml
Google Detected
McAfee Artemis!9E57567EE212
MAX malware (ai score=83)
Cylance unsafe
Fortinet W32/Injector.ESYW!tr
AVG Win32:PWSX-gen [Trj]
DeepInstinct MALICIOUS
CrowdStrike win/malicious_confidence_100% (D)