Summary | ZeroBOX

Category	Machine	Started	Completed
FILE	s1_win7_x6403_us	May 28, 2023, 1:45 p.m.	May 28, 2023, 2:23 p.m.

Size	141.2KB
Type	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
MD5	`880cc09f6957f8eea513d876344ac5ba`
SHA256	`374038d3b479d64d002df14a62bc561394613510b82cfbdbce25d18aaab03d27`
CRC32	`226F4EAB`
ssdeep	`1536:P5JHLKlrwB3YlCLtA1myrCM+tKB5dTsET3fA/gthm4dpqgU/KMkDE7JnRlFrkPtd:QlKnwCtM3fvhzqguKMkDEDu`
Yara	UPX_Zero - UPX packed file Is_DotNET_EXE - (no description) Win_Backdoor_AsyncRAT_Zero - Win Backdoor AsyncRAT PE_Header_Zero - PE File Signature IsPE32 - (no description) Malicious_Packer_Zero - Malicious Packer

unsecapp.exe "C:\Users\test22\AppData\Local\Temp\unsecapp.exe"
2056

Name	Response	Post-Analysis Lookup
No hosts contacted.

IP Address	Status	Action
164.124.101.2	Active	Moloch
79.137.202.29	Active	Moloch

Suricata Alerts

Flow	SID	Signature	Category
TCP 192.168.56.103:49164 -> 79.137.202.29:80	2039775	ET MALWARE Laplas Clipper - Regex CnC Request	A Network Trojan was detected
TCP 192.168.56.103:49162 -> 79.137.202.29:80	2039775	ET MALWARE Laplas Clipper - Regex CnC Request	A Network Trojan was detected
TCP 192.168.56.103:49164 -> 79.137.202.29:80	2039776	ET MALWARE Laplas Clipper - SetOnline CnC Checkin	A Network Trojan was detected
TCP 192.168.56.103:49162 -> 79.137.202.29:80	2039776	ET MALWARE Laplas Clipper - SetOnline CnC Checkin	A Network Trojan was detected
TCP 192.168.56.103:49164 -> 79.137.202.29:80	2039775	ET MALWARE Laplas Clipper - Regex CnC Request	A Network Trojan was detected
TCP 192.168.56.103:49164 -> 79.137.202.29:80	2039776	ET MALWARE Laplas Clipper - SetOnline CnC Checkin	A Network Trojan was detected

Suricata TLS

No Suricata TLS

Queries for the computername (3 events)

Time & API	Arguments	Status	Return
GetComputerNameW May 28, 2023, 1:45 p.m.	computer_name: TEST22-PC	1	1
GetComputerNameW May 28, 2023, 1:46 p.m.	computer_name: TEST22-PC	1	1
GetComputerNameW May 28, 2023, 1:47 p.m.	computer_name: TEST22-PC	1	1

Checks if process is being debugged by a debugger (50 out of 240 events)

Time & API	Arguments	Status	Return	Repeated
IsDebuggerPresent May 28, 2023, 1:45 p.m.			0	0
IsDebuggerPresent May 28, 2023, 1:45 p.m.			0	0
IsDebuggerPresent May 28, 2023, 1:45 p.m.			0	0
IsDebuggerPresent May 28, 2023, 1:45 p.m.			0	0
IsDebuggerPresent May 28, 2023, 1:45 p.m.			0	0
IsDebuggerPresent May 28, 2023, 1:45 p.m.			0	0
IsDebuggerPresent May 28, 2023, 1:45 p.m.			0	0
IsDebuggerPresent May 28, 2023, 1:45 p.m.			0	0
IsDebuggerPresent May 28, 2023, 1:45 p.m.			0	0
IsDebuggerPresent May 28, 2023, 1:45 p.m.			0	0
IsDebuggerPresent May 28, 2023, 1:45 p.m.			0	0
IsDebuggerPresent May 28, 2023, 1:45 p.m.			0	0
IsDebuggerPresent May 28, 2023, 1:45 p.m.			0	0
IsDebuggerPresent May 28, 2023, 1:45 p.m.			0	0
IsDebuggerPresent May 28, 2023, 1:45 p.m.			0	0
IsDebuggerPresent May 28, 2023, 1:45 p.m.			0	0
IsDebuggerPresent May 28, 2023, 1:45 p.m.			0	0
IsDebuggerPresent May 28, 2023, 1:45 p.m.			0	0
IsDebuggerPresent May 28, 2023, 1:45 p.m.			0	0
IsDebuggerPresent May 28, 2023, 1:45 p.m.			0	0
IsDebuggerPresent May 28, 2023, 1:45 p.m.			0	0
IsDebuggerPresent May 28, 2023, 1:45 p.m.			0	0
IsDebuggerPresent May 28, 2023, 1:45 p.m.			0	0
IsDebuggerPresent May 28, 2023, 1:45 p.m.			0	0
IsDebuggerPresent May 28, 2023, 1:46 p.m.			0	0
IsDebuggerPresent May 28, 2023, 1:46 p.m.			0	0
IsDebuggerPresent May 28, 2023, 1:46 p.m.			0	0
IsDebuggerPresent May 28, 2023, 1:46 p.m.			0	0
IsDebuggerPresent May 28, 2023, 1:46 p.m.			0	0
IsDebuggerPresent May 28, 2023, 1:46 p.m.			0	0
IsDebuggerPresent May 28, 2023, 1:46 p.m.			0	0
IsDebuggerPresent May 28, 2023, 1:46 p.m.			0	0
IsDebuggerPresent May 28, 2023, 1:46 p.m.			0	0
IsDebuggerPresent May 28, 2023, 1:46 p.m.			0	0
IsDebuggerPresent May 28, 2023, 1:46 p.m.			0	0
IsDebuggerPresent May 28, 2023, 1:46 p.m.			0	0
IsDebuggerPresent May 28, 2023, 1:46 p.m.			0	0
IsDebuggerPresent May 28, 2023, 1:46 p.m.			0	0
IsDebuggerPresent May 28, 2023, 1:46 p.m.			0	0
IsDebuggerPresent May 28, 2023, 1:46 p.m.			0	0
IsDebuggerPresent May 28, 2023, 1:46 p.m.			0	0
IsDebuggerPresent May 28, 2023, 1:46 p.m.			0	0
IsDebuggerPresent May 28, 2023, 1:46 p.m.			0	0
IsDebuggerPresent May 28, 2023, 1:46 p.m.			0	0
IsDebuggerPresent May 28, 2023, 1:46 p.m.			0	0
IsDebuggerPresent May 28, 2023, 1:46 p.m.			0	0
IsDebuggerPresent May 28, 2023, 1:46 p.m.			0	0
IsDebuggerPresent May 28, 2023, 1:46 p.m.			0	0
IsDebuggerPresent May 28, 2023, 1:46 p.m.			0	0
IsDebuggerPresent May 28, 2023, 1:46 p.m.			0	0

Checks amount of memory in system, this can be used to detect virtual machines that have a low amount of memory available (1 event)

Time & API	Arguments	Status	Return	Repeated
GlobalMemoryStatusEx May 28, 2023, 1:45 p.m.		1	1	0

HTTP traffic contains suspicious features which may be indicative of malware related traffic (2 events)

suspicious_features	GET method with no useragent header, Connection to IP address				suspicious_request	GET http://79.137.202.29/bot/regex?key=afc950a4a18fd71c9d7be4c460e4cb77d0bcf29a49d097e4e739c17c332c3a34
suspicious_features	GET method with no useragent header, Connection to IP address				suspicious_request	GET http://79.137.202.29/bot/online?guid=TEST22-PC&key=afc950a4a18fd71c9d7be4c460e4cb77d0bcf29a49d097e4e739c17c332c3a34

Performs some HTTP requests (2 events)

request	GET http://79.137.202.29/bot/regex?key=afc950a4a18fd71c9d7be4c460e4cb77d0bcf29a49d097e4e739c17c332c3a34
request	GET http://79.137.202.29/bot/online?guid=TEST22-PC&key=afc950a4a18fd71c9d7be4c460e4cb77d0bcf29a49d097e4e739c17c332c3a34

Allocates read-write-execute memory (usually to unpack itself) (35 events)

Time & API	Arguments	Status
NtAllocateVirtualMemory May 28, 2023, 1:45 p.m.	process_identifier: 2056 region_size: 851968 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00610000 allocation_type: 8192 (MEM_RESERVE) process_handle: 0xffffffff	1
NtAllocateVirtualMemory May 28, 2023, 1:45 p.m.	process_identifier: 2056 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x006a0000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtProtectVirtualMemory May 28, 2023, 1:45 p.m.	process_identifier: 2056 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x73f31000 process_handle: 0xffffffff	1
NtProtectVirtualMemory May 28, 2023, 1:45 p.m.	process_identifier: 2056 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x73f32000 process_handle: 0xffffffff	1
NtAllocateVirtualMemory May 28, 2023, 1:45 p.m.	process_identifier: 2056 region_size: 1179648 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00a00000 allocation_type: 8192 (MEM_RESERVE) process_handle: 0xffffffff	1
NtAllocateVirtualMemory May 28, 2023, 1:45 p.m.	process_identifier: 2056 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00ae0000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory May 28, 2023, 1:45 p.m.	process_identifier: 2056 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00462000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory May 28, 2023, 1:45 p.m.	process_identifier: 2056 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0047c000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory May 28, 2023, 1:45 p.m.	process_identifier: 2056 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00680000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory May 28, 2023, 1:45 p.m.	process_identifier: 2056 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0046a000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory May 28, 2023, 1:45 p.m.	process_identifier: 2056 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00495000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory May 28, 2023, 1:45 p.m.	process_identifier: 2056 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0049b000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory May 28, 2023, 1:45 p.m.	process_identifier: 2056 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00497000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory May 28, 2023, 1:45 p.m.	process_identifier: 2056 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00681000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory May 28, 2023, 1:45 p.m.	process_identifier: 2056 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00682000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory May 28, 2023, 1:45 p.m.	process_identifier: 2056 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00486000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory May 28, 2023, 1:45 p.m.	process_identifier: 2056 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00683000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory May 28, 2023, 1:45 p.m.	process_identifier: 2056 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0048a000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory May 28, 2023, 1:45 p.m.	process_identifier: 2056 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00487000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory May 28, 2023, 1:45 p.m.	process_identifier: 2056 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00684000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory May 28, 2023, 1:45 p.m.	process_identifier: 2056 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00685000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory May 28, 2023, 1:45 p.m.	process_identifier: 2056 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00686000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory May 28, 2023, 1:45 p.m.	process_identifier: 2056 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00687000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory May 28, 2023, 1:45 p.m.	process_identifier: 2056 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00bef000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory May 28, 2023, 1:45 p.m.	process_identifier: 2056 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00be0000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory May 28, 2023, 1:45 p.m.	process_identifier: 2056 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00688000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory May 28, 2023, 1:45 p.m.	process_identifier: 2056 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00689000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory May 28, 2023, 1:45 p.m.	process_identifier: 2056 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0068a000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory May 28, 2023, 1:45 p.m.	process_identifier: 2056 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0068b000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory May 28, 2023, 1:45 p.m.	process_identifier: 2056 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0046c000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory May 28, 2023, 1:45 p.m.	process_identifier: 2056 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0048b000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory May 28, 2023, 1:45 p.m.	process_identifier: 2056 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0068c000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory May 28, 2023, 1:45 p.m.	process_identifier: 2056 region_size: 16384 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00be1000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory May 28, 2023, 1:45 p.m.	process_identifier: 2056 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0068d000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory May 28, 2023, 1:45 p.m.	process_identifier: 2056 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x006a1000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1

A process attempted to delay the analysis task. (1 event)

description

unsecapp.exe tried to sleep 156 seconds, actually delayed analysis time by 156 seconds

Checks adapter addresses which can be used to detect virtual network interfaces (1 event)

Time & API	Arguments	Status	Return	Repeated
GetAdaptersAddresses May 28, 2023, 1:45 p.m.	flags: 15 family: 0		111	0

Checks for the Locally Unique Identifier on the system for a suspicious privilege (1 event)

Time & API	Arguments	Status	Return	Repeated
LookupPrivilegeValueW May 28, 2023, 1:45 p.m.	system_name: privilege_name: SeDebugPrivilege	1	1	0

Communicates with host for which no DNS query was performed (1 event)

host

79.137.202.29

File has been identified by 35 AntiVirus engines on VirusTotal as malicious (35 events)

MicroWorld-eScan	Trojan.GenericKD.67258088
McAfee	Artemis!880CC09F6957
Sangfor	Trojan.Win32.Agent.Vkkp
CrowdStrike	win/malicious_confidence_100% (W)
Arcabit	Trojan.Generic.D40246E8
BitDefenderTheta	Gen:NN.ZemsilF.36196.im2@aS8j4dni
Symantec	ML.Attribute.HighConfidence
Elastic	malicious (high confidence)
ESET-NOD32	a variant of MSIL/TrojanDownloader.Agent_AGen.ATF
Cynet	Malicious (score: 99)
Kaspersky	UDS:DangerousObject.Multi.Generic
BitDefender	Trojan.GenericKD.67258088
Avast	Win32:PWSX-gen [Trj]
Emsisoft	Trojan.GenericKD.67258088 (B)
F-Secure	Heuristic.HEUR/AGEN.1360147
TrendMicro	Trojan.Win32.AMADEY.YXDE1Z
McAfee-GW-Edition	Artemis!Trojan
Trapmine	suspicious.low.ml.score
FireEye	Generic.mg.880cc09f6957f8ee
Sophos	Mal/Generic-S
SentinelOne	Static AI - Malicious PE
Webroot	W32.Trojan.Gen
Avira	HEUR/AGEN.1360147
MAX	malware (ai score=80)
Gridinsoft	Trojan.Win32.Downloader.dd!n
Microsoft	Trojan:Win32/Casdet!rfn
ZoneAlarm	HEUR:Trojan-Banker.MSIL.ClipBanker.gen
GData	Trojan.GenericKD.67258088
VBA32	CIL.HeapOverride.Heur
TrendMicro-HouseCall	Trojan.Win32.AMADEY.YXDE1Z
Rising	Downloader.Agent!8.B23 (CLOUD)
Fortinet	PossibleThreat
AVG	Win32:PWSX-gen [Trj]
Cybereason	malicious.ecf068
DeepInstinct	MALICIOUS

unsecapp.exe

Process Tree Toggle all

Network Toggle all

Suricata Toggle all

Suricata Alerts

Suricata TLS

Signatures Toggle All