Summary | ZeroBOX

Category	Machine	Started	Completed
FILE	s1_win7_x6403_us	June 5, 2023, 9:21 p.m.	June 5, 2023, 9:23 p.m.

Size	3.9MB
Type	PE32 executable (GUI) Intel 80386, for MS Windows
MD5	`6156028337e0510bd3535c891ed15029`
SHA256	`a370b1ab9d006b851888b3f1993602813694ba7248a8137e0018895cdd6bbf17`
CRC32	`71286341`
ssdeep	`24576:QVvnZSXUpShfGnZSXUpShfGnZSXUpShfeF3J5CX3uIua:QVfwEwswEwswEwed/CXfua`
PDB Path	f:\builds\vendor\sb_win32bot03_vendor_trunk\build\vendor\xulrunner-1.9.2\mozilla\compiled\xulrunner-release\xulrunner\stub\songbird.pdb
Yara	UPX_Zero - UPX packed file OS_Processor_Check_Zero - OS Processor Check Malicious_Library_Zero - Malicious_Library PE_Header_Zero - PE File Signature IsPE32 - (no description)

ddsc.exe "C:\Users\test22\AppData\Local\Temp\ddsc.exe"
872
- ffp.exe "C:\Users\test22\AppData\Local\Temp\ddsc.exe"
  2132

Name	Response	Post-Analysis Lookup
geoplugin.net	A 178.237.33.50	178.237.33.50
mmnedgeggrrva.com	A 153.92.126.196	153.92.126.196

IP Address	Status	Action
153.92.126.196	Active	Moloch
164.124.101.2	Active	Moloch
178.237.33.50	Active	Moloch

Suricata Alerts

Flow	SID	Signature	Category
TCP 192.168.56.103:49163 -> 153.92.126.196:333	2032776	ET MALWARE Remcos 3.x Unencrypted Checkin	Malware Command and Control Activity Detected
TCP 153.92.126.196:333 -> 192.168.56.103:49163	2032777	ET MALWARE Remcos 3.x Unencrypted Server Response	Malware Command and Control Activity Detected

Suricata TLS

No Suricata TLS

This executable has a PDB path (1 event)

pdb_path

f:\builds\vendor\sb_win32bot03_vendor_trunk\build\vendor\xulrunner-1.9.2\mozilla\compiled\xulrunner-release\xulrunner\stub\songbird.pdb

Checks amount of memory in system, this can be used to detect virtual machines that have a low amount of memory available (1 event)

Time & API	Arguments	Status	Return	Repeated
GlobalMemoryStatusEx June 5, 2023, 9:21 p.m.		1	1	0

The executable contains unknown PE section names indicative of a packer (could be a false positive) (4 events)

section	.berti
section	.arif
section	.ag
section	.bennie

One or more potentially interesting buffers were extracted, these generally contain injected code, configuration data, etc.

HTTP traffic contains suspicious features which may be indicative of malware related traffic (1 event)

suspicious_features

GET method with no useragent header

suspicious_request

GET http://geoplugin.net/json.gp

Performs some HTTP requests (1 event)

request

GET http://geoplugin.net/json.gp

Allocates read-write-execute memory (usually to unpack itself) (3 events)

Time & API	Arguments	Status
NtAllocateVirtualMemory June 5, 2023, 9:21 p.m.	process_identifier: 872 region_size: 503808 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x004e0000 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0xffffffff	1
NtAllocateVirtualMemory June 5, 2023, 9:21 p.m.	process_identifier: 872 region_size: 1572864 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x02240000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtProtectVirtualMemory June 5, 2023, 9:21 p.m.	process_identifier: 872 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x778bf000 process_handle: 0xffffffff	1

A process created a hidden window (1 event)

Time & API	Arguments	Status	Return	Repeated
CreateProcessInternalW June 5, 2023, 9:21 p.m.	thread_identifier: 2136 thread_handle: 0x00000284 process_identifier: 2132 current_directory: filepath: C:\Program Files (x86)\Common Files\microsoft shared\ink\pipanel.exe track: 1 command_line: "C:\Users\test22\AppData\Local\Temp\ddsc.exe" filepath_r: C:\Program Files (x86)\Common Files\microsoft shared\ink\pipanel.exe stack_pivoted: 0 creation_flags: 134217728 (CREATE_NO_WINDOW) inherit_handles: 1 process_handle: 0x00000288	1	1	0

Searches running processes potentially to identify processes for sandbox evasion, code injection or memory dumping (11 events)

Time & API	Arguments	Status	Return
Process32NextW June 5, 2023, 9:21 p.m.	snapshot_handle: 0x00000064 process_name: mobsync.exe process_identifier: 2032	1	1
Process32NextW June 5, 2023, 9:21 p.m.	snapshot_handle: 0x00000064 process_name: pw.exe process_identifier: 1684	1	1
Process32NextW June 5, 2023, 9:21 p.m.	snapshot_handle: 0x00000064 process_name: wsqmcons.exe process_identifier: 1940	1	1
Process32NextW June 5, 2023, 9:21 p.m.	snapshot_handle: 0x00000064 process_name: sdclt.exe process_identifier: 792	1	1
Process32NextW June 5, 2023, 9:21 p.m.	snapshot_handle: 0x00000064 process_name: taskhost.exe process_identifier: 1984	1	1
Process32NextW June 5, 2023, 9:21 p.m.	snapshot_handle: 0x00000064 process_name: cmd.exe process_identifier: 1616	1	1
Process32NextW June 5, 2023, 9:21 p.m.	snapshot_handle: 0x00000064 process_name: SearchProtocolHost.exe process_identifier: 1184	1	1
Process32NextW June 5, 2023, 9:21 p.m.	snapshot_handle: 0x00000064 process_name: conhost.exe process_identifier: 1096	1	1
Process32NextW June 5, 2023, 9:21 p.m.	snapshot_handle: 0x00000064 process_name: pw.exe process_identifier: 416	1	1
Process32NextW June 5, 2023, 9:21 p.m.	snapshot_handle: 0x00000290 process_name: dllhost.exe process_identifier: 2088	1	1
Process32NextW June 5, 2023, 9:21 p.m.	snapshot_handle: 0x00000290 process_name: pipanel.exe process_identifier: 2132	1	1

The binary likely contains encrypted or compressed data indicative of a packer (1 event)

section

{u'size_of_data': u'0x00085c00', u'virtual_address': u'0x00124000', u'entropy': 7.836869265673295, u'name': u'.idata', u'virtual_size': u'0x00086000'}

entropy

7.83686926567

description

A section with a high entropy has been found

Repeatedly searches for a not-found process, you may want to run a web browser during analysis (20 events)

Time & API	Arguments	Status	Return	Repeated
Process32NextW June 5, 2023, 9:21 p.m.	snapshot_handle: 0x00000064 process_name: pw.exe process_identifier: 416		0	0
Process32NextW June 5, 2023, 9:21 p.m.	snapshot_handle: 0x00000068 process_name: pw.exe process_identifier: 416		0	0
Process32NextW June 5, 2023, 9:21 p.m.	snapshot_handle: 0x0000006c process_name: pw.exe process_identifier: 416		0	0
Process32NextW June 5, 2023, 9:21 p.m.	snapshot_handle: 0x00000070 process_name: pw.exe process_identifier: 416		0	0
Process32NextW June 5, 2023, 9:21 p.m.	snapshot_handle: 0x00000074 process_name: pw.exe process_identifier: 416		0	0
Process32NextW June 5, 2023, 9:21 p.m.	snapshot_handle: 0x00000078 process_name: pw.exe process_identifier: 416		0	0
Process32NextW June 5, 2023, 9:21 p.m.	snapshot_handle: 0x0000007c process_name: pw.exe process_identifier: 416		0	0
Process32NextW June 5, 2023, 9:21 p.m.	snapshot_handle: 0x00000080 process_name: pw.exe process_identifier: 416		0	0
Process32NextW June 5, 2023, 9:21 p.m.	snapshot_handle: 0x00000084 process_name: pw.exe process_identifier: 416		0	0
Process32NextW June 5, 2023, 9:21 p.m.	snapshot_handle: 0x00000088 process_name: pw.exe process_identifier: 416		0	0
Process32NextW June 5, 2023, 9:21 p.m.	snapshot_handle: 0x0000008c process_name: pw.exe process_identifier: 416		0	0
Process32NextW June 5, 2023, 9:21 p.m.	snapshot_handle: 0x00000090 process_name: pw.exe process_identifier: 416		0	0
Process32NextW June 5, 2023, 9:21 p.m.	snapshot_handle: 0x00000094 process_name: pw.exe process_identifier: 416		0	0
Process32NextW June 5, 2023, 9:21 p.m.	snapshot_handle: 0x00000098 process_name: pw.exe process_identifier: 416		0	0
Process32NextW June 5, 2023, 9:21 p.m.	snapshot_handle: 0x0000009c process_name: pw.exe process_identifier: 416		0	0
Process32NextW June 5, 2023, 9:21 p.m.	snapshot_handle: 0x000000a0 process_name: pw.exe process_identifier: 416		0	0
Process32NextW June 5, 2023, 9:21 p.m.	snapshot_handle: 0x000000a4 process_name: pw.exe process_identifier: 416		0	0
Process32NextW June 5, 2023, 9:21 p.m.	snapshot_handle: 0x000000a8 process_name: pw.exe process_identifier: 416		0	0
Process32NextW June 5, 2023, 9:21 p.m.	snapshot_handle: 0x000000ac process_name: pw.exe process_identifier: 416		0	0
Process32NextW June 5, 2023, 9:21 p.m.	snapshot_handle: 0x000000b0 process_name: pw.exe process_identifier: 416		0	0

Uses Windows utilities for basic Windows functionality (1 event)

cmdline

"C:\Users\test22\AppData\Local\Temp\ddsc.exe"

Allocates execute permission to another process indicative of possible code injection (4 events)

Time & API	Arguments	Status
NtAllocateVirtualMemory June 5, 2023, 9:21 p.m.	process_identifier: 2132 region_size: 524288 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00400000 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0x00000288	1
NtProtectVirtualMemory June 5, 2023, 9:21 p.m.	process_identifier: 2132 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x778bf000 process_handle: 0x00000288	1
NtAllocateVirtualMemory June 5, 2023, 9:21 p.m.	process_identifier: 2132 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000e0000 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0x00000288	1
NtAllocateVirtualMemory June 5, 2023, 9:21 p.m.	process_identifier: 2132 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000f0000 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0x00000288	1

Potential code injection by writing to the memory of another process (3 events)

Time & API	Arguments	Status	Return
WriteProcessMemory June 5, 2023, 9:21 p.m.	buffer: C:\Users\test22\AppData\Roaming\ffp.exe base_address: 0x000f0000 process_identifier: 2132 process_handle: 0x00000288	1	1
WriteProcessMemory June 5, 2023, 9:21 p.m.	buffer: base_address: 0x005e2968 process_identifier: 2132 process_handle: 0x00000288	1	1
WriteProcessMemory June 5, 2023, 9:21 p.m.	buffer: base_address: 0x005e2964 process_identifier: 2132 process_handle: 0x00000288	1	1

Attempts to remove evidence of file being downloaded from the Internet (1 event)

file	C:\Users\test22\AppData\Roaming\ffp.exe:Zone.Identifier

Executed a process and injected code into it, probably while unpacking (8 events)

Time & API	Arguments	Status	Return
CreateProcessInternalW June 5, 2023, 9:21 p.m.	thread_identifier: 2136 thread_handle: 0x00000284 process_identifier: 2132 current_directory: filepath: C:\Program Files (x86)\Common Files\microsoft shared\ink\pipanel.exe track: 1 command_line: "C:\Users\test22\AppData\Local\Temp\ddsc.exe" filepath_r: C:\Program Files (x86)\Common Files\microsoft shared\ink\pipanel.exe stack_pivoted: 0 creation_flags: 134217728 (CREATE_NO_WINDOW) inherit_handles: 1 process_handle: 0x00000288	1	1
NtGetContextThread June 5, 2023, 9:21 p.m.	thread_handle: 0x00000284	1	0
NtAllocateVirtualMemory June 5, 2023, 9:21 p.m.	process_identifier: 2132 region_size: 524288 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00400000 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0x00000288	1	0
NtAllocateVirtualMemory June 5, 2023, 9:21 p.m.	process_identifier: 2132 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000e0000 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0x00000288	1	0
NtAllocateVirtualMemory June 5, 2023, 9:21 p.m.	process_identifier: 2132 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000f0000 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0x00000288	1	0
WriteProcessMemory June 5, 2023, 9:21 p.m.	buffer: C:\Users\test22\AppData\Roaming\ffp.exe base_address: 0x000f0000 process_identifier: 2132 process_handle: 0x00000288	1	1
WriteProcessMemory June 5, 2023, 9:21 p.m.	buffer: base_address: 0x005e2968 process_identifier: 2132 process_handle: 0x00000288	1	1
WriteProcessMemory June 5, 2023, 9:21 p.m.	buffer: base_address: 0x005e2964 process_identifier: 2132 process_handle: 0x00000288	1	1

File has been identified by 36 AntiVirus engines on VirusTotal as malicious (36 events)

Bkav	W32.AIDetectMalware
Lionic	Trojan.Win32.Shellcode.4!c
MicroWorld-eScan	Trojan.GenericKD.67378831
McAfee	Artemis!6156028337E0
Malwarebytes	Malware.Heuristic.1001
VIPRE	Trojan.GenericKD.67378831
Sangfor	Trojan.Win32.Agent.V56s
CrowdStrike	win/malicious_confidence_70% (W)
Arcabit	Trojan.Generic.D4041E8F
Symantec	ML.Attribute.HighConfidence
Elastic	malicious (high confidence)
Cynet	Malicious (score: 100)
APEX	Malicious
Kaspersky	HEUR:Exploit.Win32.Shellcode.gen
BitDefender	Trojan.GenericKD.67378831
NANO-Antivirus	Exploit.Win32.Shellcode.jvgund
Avast	FileRepMalware [Misc]
Tencent	Malware.Win32.Gencirc.10bdb360
Emsisoft	Trojan.GenericKD.67378831 (B)
Zillya	Exploit.ShellCode.Win32.979
McAfee-GW-Edition	BehavesLike.Win32.CoinMiner.wz
FireEye	Generic.mg.6156028337e0510b
Sophos	Mal/Generic-S
MAX	malware (ai score=89)
Microsoft	Trojan:Win32/Remcos!MTB
ZoneAlarm	HEUR:Exploit.Win32.Shellcode.gen
GData	Win32.Backdoor.Remcos.9VNCID
AhnLab-V3	Trojan/Win.Generic.C5395892
Cylance	unsafe
Panda	Trj/Chgt.AD
Rising	Trojan.Generic@AI.90 (RDML:RuldCE6oDkMGxJN31zhBww)
MaxSecure	Trojan.Malware.300983.susgen
Fortinet	W32/PossibleThreat
AVG	FileRepMalware [Misc]
Cybereason	malicious.1cacce
DeepInstinct	MALICIOUS

ddsc.exe

Process Tree Toggle all

Network Toggle all

Suricata Toggle all

Suricata Alerts

Suricata TLS

Signatures Toggle All