Summary | ZeroBOX

Category	Machine	Started	Completed
FILE	s1_win7_x6403_us	June 2, 2023, 9:22 a.m.	June 2, 2023, 9:27 a.m.

Size	145.0KB
Type	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
MD5	`3b505e72fe4fa5017eda28c54dac0c09`
SHA256	`2af21a1baedce2cc17b5e34d758ceadea94b2b0d91901471fb402ac57cc4740d`
CRC32	`CE1FAB0C`
ssdeep	`3072:7V+m5c1QmRSx9TexGWEcVASGr4Y1zeohJZF8e8hy:7jYQ6ohJP`
Yara	UPX_Zero - UPX packed file OS_Processor_Check_Zero - OS Processor Check Win32_Trojan_PWS_Net_1_Zero - Win32 Trojan PWS .NET Azorult Is_DotNET_EXE - (no description) Win_Backdoor_AsyncRAT_Zero - Win Backdoor AsyncRAT PE_Header_Zero - PE File Signature IsPE32 - (no description) ConfuserEx_Zero - Confuser .NET

Client2.jpg "C:\Users\test22\AppData\Local\Temp\Client2.jpg"
1608

Name	Response	Post-Analysis Lookup
No hosts contacted.

IP Address	Status	Action
70.36.101.185	Active	Moloch

Suricata Alerts

No Suricata Alerts

Suricata TLS

No Suricata TLS

Checks if process is being debugged by a debugger (2 events)

Time & API	Arguments	Status	Return	Repeated
IsDebuggerPresent June 2, 2023, 9:22 a.m.			0	0
IsDebuggerPresent June 2, 2023, 9:22 a.m.			0	0

Uses Windows APIs to generate a cryptographic key (14 events)

Time & API	Arguments	Status	Return
CryptExportKey June 2, 2023, 9:22 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x006d3cd8 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey June 2, 2023, 9:22 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x006d3cd8 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey June 2, 2023, 9:22 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x006d3cd8 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey June 2, 2023, 9:22 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x006d3cd8 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey June 2, 2023, 9:22 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x006d3d58 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey June 2, 2023, 9:22 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x006d3d58 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey June 2, 2023, 9:22 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x006d3c58 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey June 2, 2023, 9:22 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x006d3c58 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey June 2, 2023, 9:22 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x006d3c58 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey June 2, 2023, 9:22 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x006d3c58 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey June 2, 2023, 9:22 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x006d3c58 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey June 2, 2023, 9:22 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x006d3cd8 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey June 2, 2023, 9:22 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x006d3cd8 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey June 2, 2023, 9:22 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x006d3ed8 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1

Checks amount of memory in system, this can be used to detect virtual machines that have a low amount of memory available (1 event)

Time & API	Arguments	Status	Return	Repeated
GlobalMemoryStatusEx June 2, 2023, 9:22 a.m.		1	1	0

Allocates read-write-execute memory (usually to unpack itself) (32 events)

Time & API	Arguments	Status
NtAllocateVirtualMemory June 2, 2023, 9:22 a.m.	process_identifier: 1608 region_size: 327680 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00380000 allocation_type: 8192 (MEM_RESERVE) process_handle: 0xffffffff	1
NtAllocateVirtualMemory June 2, 2023, 9:22 a.m.	process_identifier: 1608 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00390000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtProtectVirtualMemory June 2, 2023, 9:22 a.m.	process_identifier: 1608 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x73f61000 process_handle: 0xffffffff	1
NtProtectVirtualMemory June 2, 2023, 9:22 a.m.	process_identifier: 1608 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x73f62000 process_handle: 0xffffffff	1
NtAllocateVirtualMemory June 2, 2023, 9:22 a.m.	process_identifier: 1608 region_size: 589824 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00520000 allocation_type: 8192 (MEM_RESERVE) process_handle: 0xffffffff	1
NtAllocateVirtualMemory June 2, 2023, 9:22 a.m.	process_identifier: 1608 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00570000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory June 2, 2023, 9:22 a.m.	process_identifier: 1608 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00422000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory June 2, 2023, 9:22 a.m.	process_identifier: 1608 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0043c000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory June 2, 2023, 9:22 a.m.	process_identifier: 1608 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00630000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory June 2, 2023, 9:22 a.m.	process_identifier: 1608 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00455000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory June 2, 2023, 9:22 a.m.	process_identifier: 1608 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0045b000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory June 2, 2023, 9:22 a.m.	process_identifier: 1608 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00457000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory June 2, 2023, 9:22 a.m.	process_identifier: 1608 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0042a000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory June 2, 2023, 9:22 a.m.	process_identifier: 1608 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00631000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory June 2, 2023, 9:22 a.m.	process_identifier: 1608 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00446000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory June 2, 2023, 9:22 a.m.	process_identifier: 1608 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0044a000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory June 2, 2023, 9:22 a.m.	process_identifier: 1608 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00447000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory June 2, 2023, 9:22 a.m.	process_identifier: 1608 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0044b000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory June 2, 2023, 9:22 a.m.	process_identifier: 1608 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0043a000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory June 2, 2023, 9:22 a.m.	process_identifier: 1608 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0044c000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory June 2, 2023, 9:22 a.m.	process_identifier: 1608 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0042c000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory June 2, 2023, 9:22 a.m.	process_identifier: 1608 region_size: 327680 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x7ef50000 allocation_type: 1056768 (MEM_RESERVE\|MEM_TOP_DOWN) process_handle: 0xffffffff	1
NtAllocateVirtualMemory June 2, 2023, 9:22 a.m.	process_identifier: 1608 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x7ef50000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory June 2, 2023, 9:22 a.m.	process_identifier: 1608 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x7ef50000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory June 2, 2023, 9:22 a.m.	process_identifier: 1608 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x7ef58000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory June 2, 2023, 9:22 a.m.	process_identifier: 1608 region_size: 65536 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x7ef40000 allocation_type: 1056768 (MEM_RESERVE\|MEM_TOP_DOWN) process_handle: 0xffffffff	1
NtAllocateVirtualMemory June 2, 2023, 9:22 a.m.	process_identifier: 1608 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x7ef40000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory June 2, 2023, 9:22 a.m.	process_identifier: 1608 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x7ef50000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory June 2, 2023, 9:22 a.m.	process_identifier: 1608 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x7ef58000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory June 2, 2023, 9:22 a.m.	process_identifier: 1608 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x7ef40000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory June 2, 2023, 9:22 a.m.	process_identifier: 1608 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0044d000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory June 2, 2023, 9:22 a.m.	process_identifier: 1608 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00448000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1

Communicates with host for which no DNS query was performed (1 event)

host

70.36.101.185

Connects to an IP address that is no longer responding to requests (legitimate services will remain up-and-running usually) (1 event)

dead_host

70.36.101.185:14980

File has been identified by 54 AntiVirus engines on VirusTotal as malicious (50 out of 54 events)

Lionic	Trojan.Win32.Stealer.12!c
Elastic	malicious (high confidence)
MicroWorld-eScan	IL:Trojan.MSILZilla.24965
CAT-QuickHeal	Trojan.GenericFC.S30114712
McAfee	Trojan-FRAX!3B505E72FE4F
Malwarebytes	Generic.Malware.AI.DDS
Sangfor	Suspicious.Win32.Save.a
K7AntiVirus	Spyware ( 005690661 )
Alibaba	TrojanSpy:MSIL/Stealer.a837ce9c
K7GW	Spyware ( 005690661 )
Arcabit	IL:Trojan.MSILZilla.D6185
BitDefenderTheta	Gen:NN.ZemsilCO.36250.jm0@aaOy22o
VirIT	Trojan.Win32.MSIL_Heur.A
Cyren	W32/MSIL_Troj.CNJ.gen!Eldorado
Symantec	Trojan.Whispergate
tehtris	Generic.Malware
ESET-NOD32	a variant of MSIL/Spy.RedLine.A
APEX	Malicious
ClamAV	Win.Trojan.Redline-9938775-1
Kaspersky	HEUR:Trojan-Spy.MSIL.Stealer.gen
BitDefender	IL:Trojan.MSILZilla.24965
Avast	Win32:PWSX-gen [Trj]
Emsisoft	IL:Trojan.MSILZilla.24965 (B)
F-Secure	Heuristic.HEUR/AGEN.1307453
DrWeb	Trojan.PWS.StealerNET.125
VIPRE	IL:Trojan.MSILZilla.24965
TrendMicro	TrojanSpy.Win32.REDLINE.YXDE4Z
McAfee-GW-Edition	BehavesLike.Win32.AgentTesla.cm
FireEye	Generic.mg.3b505e72fe4fa501
Sophos	Mal/Reline-B
SentinelOne	Static AI - Malicious PE
Avira	HEUR/AGEN.1307453
Antiy-AVL	Trojan[Spy]/MSIL.RedLine
Gridinsoft	Malware.Win32.RedLine.bot
Microsoft	Trojan:MSIL/RedLineStealer.EH!MTB
ViRobot	Trojan.Win.Z.Redline.148480.BF
ZoneAlarm	HEUR:Trojan-Spy.MSIL.Stealer.gen
GData	MSIL.Trojan-Stealer.Redline.G
Cynet	Malicious (score: 99)
AhnLab-V3	Trojan/Win.FRAX.C5368383
Acronis	suspicious
VBA32	Trojan.MSIL.InfoStealer.gen.U
ALYac	IL:Trojan.MSILZilla.24965
MAX	malware (ai score=80)
Cylance	unsafe
Panda	Trj/GdSda.A
TrendMicro-HouseCall	TrojanSpy.Win32.REDLINE.YXDE4Z
Rising	Stealer.Agent!1.DC63 (CLASSIC)
Ikarus	Trojan.MSIL.RedLine
MaxSecure	Trojan.Malware.300983.susgen

Client2.jpg

Process Tree Toggle all

Network Toggle all

Suricata Toggle all

Suricata Alerts

Suricata TLS

Signatures Toggle All