popup
Summary | ZeroBOX
  1. Home
  2. Result
  3. Report
  4. Detail Analysis

Password_2022_Installer.rar

KeyLogger Escalate priviledges AntiDebug AntiVM
  1. Resubmit sample
Category Machine Started Completed
FILE s1_win7_x6402 June 2, 2023, 6:52 p.m. June 2, 2023, 6:54 p.m.
Size 21.9MB
Type RAR archive data, v5
MD5 255ec60f26fc08b0b1a3ef793ad33bfb
SHA256 d19cfacb446d548b93e2d9f236bf67b25adfd7297233ad8a21c900534520e0b8
CRC32 EC98621C
ssdeep 393216:QKSQLiQ4AKQBDlyPtH8V1qFayFV6QguryGszJFiyF33Fpe8XMUg2:QKVLi5AKQBDkenXyFoKy9zbFn2sMu
Yara None matched

Name Response Post-Analysis Lookup
No hosts contacted.
IP Address Status Action
164.124.101.2 Active Moloch
89.116.255.182 Active Moloch

Suricata Alerts

Flow SID Signature Category
TCP 192.168.56.102:49191 -> 89.116.255.182:80 2043206 ET MALWARE Win32/Lumma Stealer Data Exfiltration Attempt M2 A Network Trojan was detected
TCP 192.168.56.102:49191 -> 89.116.255.182:80 2043206 ET MALWARE Win32/Lumma Stealer Data Exfiltration Attempt M2 A Network Trojan was detected
TCP 192.168.56.102:49191 -> 89.116.255.182:80 2043206 ET MALWARE Win32/Lumma Stealer Data Exfiltration Attempt M2 A Network Trojan was detected
TCP 89.116.255.182:80 -> 192.168.56.102:49191 2221010 SURICATA HTTP unable to match response to request Generic Protocol Command Decode
TCP 89.116.255.182:80 -> 192.168.56.102:49191 2221010 SURICATA HTTP unable to match response to request Generic Protocol Command Decode
TCP 89.116.255.182:80 -> 192.168.56.102:49191 2221010 SURICATA HTTP unable to match response to request Generic Protocol Command Decode
TCP 89.116.255.182:80 -> 192.168.56.102:49191 2221010 SURICATA HTTP unable to match response to request Generic Protocol Command Decode
TCP 89.116.255.182:80 -> 192.168.56.102:49191 2221010 SURICATA HTTP unable to match response to request Generic Protocol Command Decode
TCP 89.116.255.182:80 -> 192.168.56.102:49191 2221010 SURICATA HTTP unable to match response to request Generic Protocol Command Decode
TCP 89.116.255.182:80 -> 192.168.56.102:49191 2221010 SURICATA HTTP unable to match response to request Generic Protocol Command Decode
TCP 89.116.255.182:80 -> 192.168.56.102:49191 2221010 SURICATA HTTP unable to match response to request Generic Protocol Command Decode
TCP 89.116.255.182:80 -> 192.168.56.102:49191 2221010 SURICATA HTTP unable to match response to request Generic Protocol Command Decode
TCP 89.116.255.182:80 -> 192.168.56.102:49191 2221010 SURICATA HTTP unable to match response to request Generic Protocol Command Decode
TCP 89.116.255.182:80 -> 192.168.56.102:49191 2221010 SURICATA HTTP unable to match response to request Generic Protocol Command Decode

Suricata TLS

No Suricata TLS

Time & API Arguments Status Return Repeated

IsDebuggerPresent

 0 0
Time & API Arguments Status Return Repeated

GlobalMemoryStatusEx

 1 1 0
suspicious_features POST method with no referer header, Connection to IP address suspicious_request POST http://89.116.255.182/c2sock
request POST http://89.116.255.182/c2sock
request POST http://89.116.255.182/c2sock
Time & API Arguments Status Return Repeated

NtProtectVirtualMemory

 process_identifier: 2196
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x74002000
process_handle: 0xffffffff
1 0 0

NtProtectVirtualMemory

 process_identifier: 2196
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x737e3000
process_handle: 0xffffffff
1 0 0
file C:\Users\test22\AppData\Local\Temp\7zE49891E36\nssckbi.dll
file C:\Users\test22\AppData\Local\Temp\7zE49891E36\Installerx64.exe
file C:\Users\test22\AppData\Local\Temp\7zE49891E36\IA2Marshal.dll
file C:\Users\test22\AppData\Local\Temp\7zE49891E36\libgcc_s_dw2-1.dll
file C:\Users\test22\AppData\Local\Temp\7zE49891E36\AccessibleHandler.dll
file C:\Users\test22\AppData\Local\Temp\7zE49891E36\Forms\Internet_Advertisement\Internet_Advertisement_DLL.dll
file C:\Users\test22\AppData\Local\Temp\7zE49891E36\libEGL.dll
Time & API Arguments Status Return Repeated

LookupPrivilegeValueW

 system_name:
privilege_name: SeRestorePrivilege
1 1 0

LookupPrivilegeValueW

 system_name:
privilege_name: SeSecurityPrivilege
1 1 0
description PWS Memory rule Generic_PWS_Memory_Zero
description Escalate priviledges rule Escalate_priviledges
description (no description) rule DebuggerCheck__GlobalFlags
description (no description) rule DebuggerCheck__QueryInfo
description (no description) rule DebuggerHiding__Thread
description (no description) rule DebuggerHiding__Active
description (no description) rule ThreadControl__Context
description (no description) rule SEH__vectored
description Checks if being debugged rule anti_dbg
description Bypass DEP rule disable_dep
description Run a KeyLogger rule KeyLogger
host 89.116.255.182