popup
Summary | ZeroBOX
  1. Home
  2. Result
  3. Report
  4. Detail Analysis

pt274.exe

UPX Socket ScreenShot DNS AntiDebug PE File PE32 .NET EXE AntiVM
  1. Resubmit sample
Category Machine Started Completed
FILE s1_win7_x6403_us June 11, 2023, 10:52 p.m. June 11, 2023, 11:20 p.m.
Size 1.1MB
Type PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
MD5 44137725eba04c72f7486f45192cb768
SHA256 3df0f256ad5241af5c4c20fe732af0fd96166e7c2746ba0b91a0359813a9f783
CRC32 C71C915D
ssdeep 24576:bhw22EZ+KBiqxUwCf/mx7n1JaofmsTuemMy9aP50Xt:lt2q+IiBzBahmM9P50X
Yara
  • UPX_Zero - UPX packed file
  • Is_DotNET_EXE - (no description)
  • PE_Header_Zero - PE File Signature
  • Win_Backdoor_AsyncRAT_Zero - Win Backdoor AsyncRAT
  • IsPE32 - (no description)

Name Response Post-Analysis Lookup
No hosts contacted.
IP Address Status Action
84.54.50.66 Active Moloch

Suricata Alerts

No Suricata Alerts

Suricata TLS

No Suricata TLS

Time & API Arguments Status Return Repeated

IsDebuggerPresent

 0 0

IsDebuggerPresent

 0 0

IsDebuggerPresent

 0 0
Time & API Arguments Status Return Repeated

GlobalMemoryStatusEx

 1 1 0
Time & API Arguments Status Return Repeated

NtAllocateVirtualMemory

 process_identifier: 1700
region_size: 1441792
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x00690000
allocation_type: 8192 (MEM_RESERVE)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 1700
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x007b0000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtProtectVirtualMemory

 process_identifier: 1700
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x73f31000
process_handle: 0xffffffff
1 0 0

NtProtectVirtualMemory

 process_identifier: 1700
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x73f32000
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 1700
region_size: 2097152
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x021e0000
allocation_type: 8192 (MEM_RESERVE)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 1700
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x023a0000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 1700
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x00522000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 1700
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x00555000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 1700
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x0055b000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 1700
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x00557000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 1700
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x0053c000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 1700
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x00630000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 1700
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x0052a000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 1700
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x00546000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 1700
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x0054a000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 1700
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x00547000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 1700
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x0053a000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 1700
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x00631000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0
section {u'size_of_data': u'0x00110600', u'virtual_address': u'0x00002000', u'entropy': 7.9966864429480475, u'name': u'.text', u'virtual_size': u'0x001104b2'} entropy 7.99668644295 description A section with a high entropy has been found
section {u'size_of_data': u'0x00004400', u'virtual_address': u'0x00114000', u'entropy': 7.7209864303072395, u'name': u'.rsrc', u'virtual_size': u'0x000042a6'} entropy 7.72098643031 description A section with a high entropy has been found
entropy 0.999548328817 description Overall entropy of this PE file is high
url https://www.chiark.greenend.org.uk/
description Communications over RAW Socket rule Network_TCP_Socket
description Communications use DNS rule Network_DNS
description PWS Memory rule Generic_PWS_Memory_Zero
description Win32 PWS Loki rule Win32_PWS_Loki_Zero
description (no description) rule DebuggerCheck__GlobalFlags
description (no description) rule DebuggerCheck__QueryInfo
description (no description) rule DebuggerHiding__Thread
description (no description) rule DebuggerHiding__Active
description (no description) rule ThreadControl__Context
description (no description) rule SEH__vectored
description Checks if being debugged rule anti_dbg
description Bypass DEP rule disable_dep
description Take ScreenShot rule ScreenShot
host 84.54.50.66
Time & API Arguments Status Return Repeated

NtAllocateVirtualMemory

 process_identifier: 2220
region_size: 1118208
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x00400000
allocation_type: 12288 (MEM_COMMIT|MEM_RESERVE)
process_handle: 0x00000264
1 0 0
registry HKEY_CURRENT_USER\Software\SimonTatham\PuTTY\Sessions
Time & API Arguments Status Return Repeated

WriteProcessMemory

 buffer: MZx@xº´ Í!¸LÍ!This program cannot be run in DOS mode.$PEL¾>‡]à Ø –þ@Ž@P5 ´Ð 0°|=q© \,; (.text^ÖØ `.rdata¬lðnÜ@@.data0N` J @À.00cfg° T @@.gfids´À V @@.rsrc0°Ð ²X @@.relocqr @B
base_address: 0x00400000
process_identifier: 2220
process_handle: 0x00000264
1 1 0

WriteProcessMemory

 buffer: ´"IÈ"IÐ"IØ"Ià"Iè"Ið"Iø"I UÊJ(`K(`KØ|C5ËJXƒINlh†I ÿÿÿÿÿÿÿÿÿÿÿÿ±¿DNæ@»u˜ÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿ€ ¤`‚y‚!¦ß¡¥Ÿàü@~€ü¨Á£Ú£ þ@þµÁ£Ú£ þAþ¶Ï¢ä¢å¢è¢[þ@~¡þQQÚ^Ú _ÚjÚ2ÓØÞàù1~þ abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZøcK(¾IàfKàfKàfKàfKàfK¸gK¨ÀI(ÂIP¸I fKøcKC    "»I..°gK@­K@­K@­K@­K@­K@­K@­K@­K@­K´gKD­KD­KD­KD­KD­KD­KD­Kþÿÿÿ “PSTPDT(iKhiKÿÿÿÿÿÿÿÿþÿÿÿ
base_address: 0x004b6000
process_identifier: 2220
process_handle: 0x00000264
1 1 0

WriteProcessMemory

 buffer: þG
base_address: 0x004bb000
process_identifier: 2220
process_handle: 0x00000264
1 1 0

WriteProcessMemory

 buffer: Úõ12Ú]2Ú½Új S T2I 8 Ù ˜ ÚÚŸy2ã1дu´¢ °«EC’NϗK23Ð3¥ÌÏ Er4 Y
base_address: 0x004bc000
process_identifier: 2220
process_handle: 0x00000264
1 1 0

WriteProcessMemory

 buffer: @
base_address: 0xfffde008
process_identifier: 2220
process_handle: 0x00000264
1 1 0
Time & API Arguments Status Return Repeated

WriteProcessMemory

 buffer: MZx@xº´ Í!¸LÍ!This program cannot be run in DOS mode.$PEL¾>‡]à Ø –þ@Ž@P5 ´Ð 0°|=q© \,; (.text^ÖØ `.rdata¬lðnÜ@@.data0N` J @À.00cfg° T @@.gfids´À V @@.rsrc0°Ð ²X @@.relocqr @B
base_address: 0x00400000
process_identifier: 2220
process_handle: 0x00000264
1 1 0
Process injection Process 1700 called NtSetContextThread to modify thread in remote process 2220
Time & API Arguments Status Return Repeated

NtSetContextThread

 registers.eip: 0
registers.esp: 0
registers.edi: 0
registers.eax: 4652694
registers.ebp: 0
registers.edx: 0
registers.ebx: -139264
registers.esi: 0
registers.ecx: 0
thread_handle: 0x00000260
process_identifier: 2220
1 0 0
Process injection Process 1700 resumed a thread in remote process 2220
Time & API Arguments Status Return Repeated

NtResumeThread

 thread_handle: 0x00000260
suspend_count: 1
process_identifier: 2220
1 0 0
Time & API Arguments Status Return Repeated

NtResumeThread

 thread_handle: 0x000000e0
suspend_count: 1
process_identifier: 1700
1 0 0

NtResumeThread

 thread_handle: 0x00000158
suspend_count: 1
process_identifier: 1700
1 0 0

NtResumeThread

 thread_handle: 0x00000194
suspend_count: 1
process_identifier: 1700
1 0 0

CreateProcessInternalW

 thread_identifier: 2224
thread_handle: 0x00000260
process_identifier: 2220
current_directory:
filepath: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe
track: 1
command_line: "C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe"
filepath_r: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe
stack_pivoted: 0
creation_flags: 4 (CREATE_SUSPENDED)
inherit_handles: 0
process_handle: 0x00000264
1 1 0

NtGetContextThread

 thread_handle: 0x00000260
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2220
region_size: 1118208
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x00400000
allocation_type: 12288 (MEM_COMMIT|MEM_RESERVE)
process_handle: 0x00000264
1 0 0

WriteProcessMemory

 buffer: MZx@xº´ Í!¸LÍ!This program cannot be run in DOS mode.$PEL¾>‡]à Ø –þ@Ž@P5 ´Ð 0°|=q© \,; (.text^ÖØ `.rdata¬lðnÜ@@.data0N` J @À.00cfg° T @@.gfids´À V @@.rsrc0°Ð ²X @@.relocqr @B
base_address: 0x00400000
process_identifier: 2220
process_handle: 0x00000264
1 1 0

WriteProcessMemory

 buffer:
base_address: 0x00401000
process_identifier: 2220
process_handle: 0x00000264
1 1 0

WriteProcessMemory

 buffer:
base_address: 0x0048f000
process_identifier: 2220
process_handle: 0x00000264
1 1 0

WriteProcessMemory

 buffer: ´"IÈ"IÐ"IØ"Ià"Iè"Ið"Iø"I UÊJ(`K(`KØ|C5ËJXƒINlh†I ÿÿÿÿÿÿÿÿÿÿÿÿ±¿DNæ@»u˜ÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿ€ ¤`‚y‚!¦ß¡¥Ÿàü@~€ü¨Á£Ú£ þ@þµÁ£Ú£ þAþ¶Ï¢ä¢å¢è¢[þ@~¡þQQÚ^Ú _ÚjÚ2ÓØÞàù1~þ abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZøcK(¾IàfKàfKàfKàfKàfK¸gK¨ÀI(ÂIP¸I fKøcKC    "»I..°gK@­K@­K@­K@­K@­K@­K@­K@­K@­K´gKD­KD­KD­KD­KD­KD­KD­Kþÿÿÿ “PSTPDT(iKhiKÿÿÿÿÿÿÿÿþÿÿÿ
base_address: 0x004b6000
process_identifier: 2220
process_handle: 0x00000264
1 1 0

WriteProcessMemory

 buffer: þG
base_address: 0x004bb000
process_identifier: 2220
process_handle: 0x00000264
1 1 0

WriteProcessMemory

 buffer: Úõ12Ú]2Ú½Új S T2I 8 Ù ˜ ÚÚŸy2ã1дu´¢ °«EC’NϗK23Ð3¥ÌÏ Er4 Y
base_address: 0x004bc000
process_identifier: 2220
process_handle: 0x00000264
1 1 0

WriteProcessMemory

 buffer:
base_address: 0x004bd000
process_identifier: 2220
process_handle: 0x00000264
1 1 0

WriteProcessMemory

 buffer:
base_address: 0x00509000
process_identifier: 2220
process_handle: 0x00000264
1 1 0

WriteProcessMemory

 buffer: @
base_address: 0xfffde008
process_identifier: 2220
process_handle: 0x00000264
1 1 0

NtSetContextThread

 registers.eip: 0
registers.esp: 0
registers.edi: 0
registers.eax: 4652694
registers.ebp: 0
registers.edx: 0
registers.ebx: -139264
registers.esi: 0
registers.ecx: 0
thread_handle: 0x00000260
process_identifier: 2220
1 0 0

NtResumeThread

 thread_handle: 0x00000260
suspend_count: 1
process_identifier: 2220
1 0 0

NtResumeThread

 thread_handle: 0x0000017c
suspend_count: 1
process_identifier: 2220
1 0 0
Bkav W32.AIDetectMalware
Lionic Trojan.Win32.Stealer.12!c
Elastic malicious (high confidence)
MicroWorld-eScan IL:Trojan.MSILMamut.11009
McAfee Artemis!44137725EBA0
Malwarebytes Trojan.MalPack
Sangfor Suspicious.Win32.Save.a
Alibaba TrojanSpy:MSIL/Stealer.2a42a316
K7GW Trojan ( 0059df7d1 )
Cybereason malicious.dd261b
Arcabit IL:Trojan.MSILMamut.D2B01
BitDefenderTheta Gen:NN.ZemsilF.36250.fn0@aG50s@eG
Cyren W32/ABRisk.VYQF-0881
Symantec ML.Attribute.HighConfidence
tehtris Generic.Malware
ESET-NOD32 a variant of MSIL/Kryptik.AHUA
APEX Malicious
Cynet Malicious (score: 100)
Kaspersky HEUR:Trojan-Spy.MSIL.Stealer.gen
BitDefender IL:Trojan.MSILMamut.11009
Avast Win32:PWSX-gen [Trj]
Tencent Msil.Trojan-Spy.Stealer.Qgil
Emsisoft IL:Trojan.MSILMamut.11009 (B)
F-Secure Trojan.TR/Kryptik.naedf
DrWeb Trojan.Inject4.58216
VIPRE IL:Trojan.MSILMamut.11009
TrendMicro TROJ_GEN.R014C0WF923
McAfee-GW-Edition BehavesLike.Win32.Generic.tc
Trapmine malicious.high.ml.score
FireEye Generic.mg.44137725eba04c72
Sophos Mal/Generic-S
Ikarus Win32.Outbreak
Avira TR/Kryptik.naedf
Antiy-AVL Trojan/MSIL.Kryptik
Microsoft Trojan:Win32/Casdet!rfn
ViRobot Trojan.Win.Z.Kryptik.1134080
ZoneAlarm HEUR:Trojan-Spy.MSIL.Stealer.gen
GData IL:Trojan.MSILMamut.11009
Google Detected
AhnLab-V3 Trojan/Win.Vidar.C5431114
Acronis suspicious
ALYac IL:Trojan.MSILMamut.11009
MAX malware (ai score=89)
Cylance unsafe
TrendMicro-HouseCall TROJ_GEN.R014C0WF923
Rising Malware.Obfus/MSIL@AI.100 (RDM.MSIL2:KRrzVPX1Tl7q+tj9pCLENg)
SentinelOne Static AI - Malicious PE
MaxSecure Trojan.Malware.300983.susgen
Fortinet MSIL/Kryptik.AEBO!tr
AVG Win32:PWSX-gen [Trj]