popup
Summary | ZeroBOX
  1. Home
  2. Result
  3. Report
  4. Detail Analysis

unsecapp.exe

Formbook NSIS UPX Malicious Library PE File DLL OS Processor Check PE32
  1. Resubmit sample
Category Machine Started Completed
FILE s1_win7_x6403_us June 20, 2023, 7:37 a.m. June 20, 2023, 7:42 a.m.
Size 286.4KB
Type PE32 executable (GUI) Intel 80386, for MS Windows, Nullsoft Installer self-extracting archive
MD5 d295211b783d0ef3be258ab3c84eaf74
SHA256 678aa6c076f895db645c592cb306c005b685d8f8629e98da6bff6bbd9db661ff
CRC32 335100FC
ssdeep 6144:vYa6BTppMsDGDqKv/1AgOEloa62ZNwvZESHhFVlibpOfJtmLivX:vYbTpOsDGDz31AgPPfwthFVliQmL4X
Yara
  • UPX_Zero - UPX packed file
  • Malicious_Library_Zero - Malicious_Library
  • NSIS_Installer - Null Soft Installer
  • PE_Header_Zero - PE File Signature
  • IsPE32 - (no description)

Suricata Alerts

Flow SID Signature Category
TCP 192.168.56.103:49186 -> 154.39.174.239:80 2031413 ET MALWARE FormBook CnC Checkin (POST) M2 Malware Command and Control Activity Detected
TCP 192.168.56.103:49168 -> 20.255.200.185:80 2031413 ET MALWARE FormBook CnC Checkin (POST) M2 Malware Command and Control Activity Detected
TCP 192.168.56.103:49177 -> 91.195.240.123:80 2031413 ET MALWARE FormBook CnC Checkin (POST) M2 Malware Command and Control Activity Detected
TCP 192.168.56.103:49174 -> 198.49.23.145:80 2031413 ET MALWARE FormBook CnC Checkin (POST) M2 Malware Command and Control Activity Detected
TCP 192.168.56.103:49180 -> 172.67.153.64:80 2031413 ET MALWARE FormBook CnC Checkin (POST) M2 Malware Command and Control Activity Detected
TCP 192.168.56.103:49183 -> 162.0.231.6:80 2031413 ET MALWARE FormBook CnC Checkin (POST) M2 Malware Command and Control Activity Detected
UDP 192.168.56.103:62576 -> 164.124.101.2:53 2023883 ET DNS Query to a *.top domain - Likely Hostile Potentially Bad Traffic
TCP 192.168.56.103:49176 -> 198.49.23.145:80 2031412 ET MALWARE FormBook CnC Checkin (GET) Malware Command and Control Activity Detected
TCP 192.168.56.103:49176 -> 198.49.23.145:80 2031449 ET MALWARE FormBook CnC Checkin (GET) Malware Command and Control Activity Detected
TCP 192.168.56.103:49176 -> 198.49.23.145:80 2031453 ET MALWARE FormBook CnC Checkin (GET) Malware Command and Control Activity Detected
TCP 192.168.56.103:49179 -> 91.195.240.123:80 2031412 ET MALWARE FormBook CnC Checkin (GET) Malware Command and Control Activity Detected
TCP 192.168.56.103:49179 -> 91.195.240.123:80 2031449 ET MALWARE FormBook CnC Checkin (GET) Malware Command and Control Activity Detected
TCP 192.168.56.103:49179 -> 91.195.240.123:80 2031453 ET MALWARE FormBook CnC Checkin (GET) Malware Command and Control Activity Detected
TCP 192.168.56.103:49170 -> 20.255.200.185:80 2031412 ET MALWARE FormBook CnC Checkin (GET) Malware Command and Control Activity Detected
TCP 192.168.56.103:49170 -> 20.255.200.185:80 2031449 ET MALWARE FormBook CnC Checkin (GET) Malware Command and Control Activity Detected
TCP 192.168.56.103:49170 -> 20.255.200.185:80 2031453 ET MALWARE FormBook CnC Checkin (GET) Malware Command and Control Activity Detected
TCP 192.168.56.103:49182 -> 172.67.153.64:80 2031412 ET MALWARE FormBook CnC Checkin (GET) Malware Command and Control Activity Detected
TCP 192.168.56.103:49182 -> 172.67.153.64:80 2031449 ET MALWARE FormBook CnC Checkin (GET) Malware Command and Control Activity Detected
TCP 192.168.56.103:49182 -> 172.67.153.64:80 2031453 ET MALWARE FormBook CnC Checkin (GET) Malware Command and Control Activity Detected
TCP 192.168.56.103:49171 -> 104.21.44.192:80 2031413 ET MALWARE FormBook CnC Checkin (POST) M2 Malware Command and Control Activity Detected
TCP 192.168.56.103:49173 -> 104.21.44.192:80 2031412 ET MALWARE FormBook CnC Checkin (GET) Malware Command and Control Activity Detected
TCP 192.168.56.103:49173 -> 104.21.44.192:80 2031449 ET MALWARE FormBook CnC Checkin (GET) Malware Command and Control Activity Detected
TCP 192.168.56.103:49173 -> 104.21.44.192:80 2031453 ET MALWARE FormBook CnC Checkin (GET) Malware Command and Control Activity Detected
TCP 192.168.56.103:49173 -> 104.21.44.192:80 2031088 ET HUNTING Request to .XYZ Domain with Minimal Headers Potentially Bad Traffic
TCP 192.168.56.103:49166 -> 195.161.62.100:80 2031412 ET MALWARE FormBook CnC Checkin (GET) Malware Command and Control Activity Detected
TCP 192.168.56.103:49166 -> 195.161.62.100:80 2031449 ET MALWARE FormBook CnC Checkin (GET) Malware Command and Control Activity Detected
TCP 192.168.56.103:49166 -> 195.161.62.100:80 2031453 ET MALWARE FormBook CnC Checkin (GET) Malware Command and Control Activity Detected
TCP 192.168.56.103:49185 -> 162.0.231.6:80 2031412 ET MALWARE FormBook CnC Checkin (GET) Malware Command and Control Activity Detected
TCP 192.168.56.103:49185 -> 162.0.231.6:80 2031449 ET MALWARE FormBook CnC Checkin (GET) Malware Command and Control Activity Detected
TCP 192.168.56.103:49185 -> 162.0.231.6:80 2031453 ET MALWARE FormBook CnC Checkin (GET) Malware Command and Control Activity Detected

Suricata TLS

No Suricata TLS

Time & API Arguments Status Return Repeated

GlobalMemoryStatusEx

 1 1 0
section .ndata
suspicious_features GET method with no useragent header suspicious_request GET http://www.ketocanadmqy.cloud/ogeb/?zS=JCW7LwLHnn7ptjGjE5oXohZmdFlQQ26ARwAmaoNxO6ijvQN7ubUT60jiWusc3p3YeBdlnORuW+NtBTBOf6MBl7CRUR/NRW0MRl+FZL4=&lQHIIB=UDOd2iazjyW
suspicious_features GET method with no useragent header suspicious_request GET http://www.gnhxxiazai03.com/ogeb/?zS=wBih4ktWfPNsySsqn3uI1HmQOkxE78XnlLTDvxJFz8Ksfyo9cnxjh72KIWiVUUXAXHwdyJ5YpLQGYf4Z+A02Vjn9hAcAu81BvwPbwlI=&lQHIIB=UDOd2iazjyW
suspicious_features GET method with no useragent header suspicious_request GET http://www.r1146.xyz/ogeb/?zS=hQC9FzST15eBXJ4J4T0DlrZN3V4nndOGJI8rCOq0KQaVihaPabvY2aUaE4N/PK/Cku54qUwIUhcWHwQfhhinhH5BJGjDnxoo3iDp4OU=&lQHIIB=UDOd2iazjyW
suspicious_features GET method with no useragent header suspicious_request GET http://www.drstephaniebest.com/ogeb/?zS=+v0OuBHGG6cw5ZwrQCjmtsYbU4xaGL5HoMfXaXw9oSi2F/e6KL+7wkfrHW9mkq7nBIGbSiwCyL8lMMQd9mW+kFWaqBx5WK5Isw5ml80=&lQHIIB=UDOd2iazjyW
suspicious_features GET method with no useragent header suspicious_request GET http://www.nicejunq.com/ogeb/?zS=61GncP3LZGSS1NuGOhw0w9YAjVqrgaXoImnMpoqiHfpClz+VkHF1OaSSbCiQjyR+WlMAeIDV0LjpJ/XsdXKhboCqPvNVkna3o/MBoBk=&lQHIIB=UDOd2iazjyW
suspicious_features GET method with no useragent header suspicious_request GET http://www.fb99vn.com/ogeb/?zS=OXN+k+OlhXjl96bKh2NTgPCFs15ire34/TTevHac9SK8WXddN+80UbpDpODSd5z2qlIY7v82+nyluTO39li1mIxMKX8Jb/R8tbta/VI=&lQHIIB=UDOd2iazjyW
suspicious_features GET method with no useragent header suspicious_request GET http://www.poshkits.info/ogeb/?zS=AqRXXMRheGbbuzNJ7gUd3ELHirevyxJNjMj6aH1i+QGnsBV8j36ZsXkdOVofclXLXJuwnJ0etyY1DKNGveWcGaTGb3YRrubSnMygGeg=&lQHIIB=UDOd2iazjyW
request POST http://www.ketocanadmqy.cloud/ogeb/
request GET http://www.ketocanadmqy.cloud/ogeb/?zS=JCW7LwLHnn7ptjGjE5oXohZmdFlQQ26ARwAmaoNxO6ijvQN7ubUT60jiWusc3p3YeBdlnORuW+NtBTBOf6MBl7CRUR/NRW0MRl+FZL4=&lQHIIB=UDOd2iazjyW
request GET http://www.sqlite.org/2017/sqlite-dll-win32-x86-3190000.zip
request POST http://www.gnhxxiazai03.com/ogeb/
request GET http://www.gnhxxiazai03.com/ogeb/?zS=wBih4ktWfPNsySsqn3uI1HmQOkxE78XnlLTDvxJFz8Ksfyo9cnxjh72KIWiVUUXAXHwdyJ5YpLQGYf4Z+A02Vjn9hAcAu81BvwPbwlI=&lQHIIB=UDOd2iazjyW
request POST http://www.r1146.xyz/ogeb/
request GET http://www.r1146.xyz/ogeb/?zS=hQC9FzST15eBXJ4J4T0DlrZN3V4nndOGJI8rCOq0KQaVihaPabvY2aUaE4N/PK/Cku54qUwIUhcWHwQfhhinhH5BJGjDnxoo3iDp4OU=&lQHIIB=UDOd2iazjyW
request POST http://www.drstephaniebest.com/ogeb/
request GET http://www.drstephaniebest.com/ogeb/?zS=+v0OuBHGG6cw5ZwrQCjmtsYbU4xaGL5HoMfXaXw9oSi2F/e6KL+7wkfrHW9mkq7nBIGbSiwCyL8lMMQd9mW+kFWaqBx5WK5Isw5ml80=&lQHIIB=UDOd2iazjyW
request POST http://www.nicejunq.com/ogeb/
request GET http://www.nicejunq.com/ogeb/?zS=61GncP3LZGSS1NuGOhw0w9YAjVqrgaXoImnMpoqiHfpClz+VkHF1OaSSbCiQjyR+WlMAeIDV0LjpJ/XsdXKhboCqPvNVkna3o/MBoBk=&lQHIIB=UDOd2iazjyW
request POST http://www.fb99vn.com/ogeb/
request GET http://www.fb99vn.com/ogeb/?zS=OXN+k+OlhXjl96bKh2NTgPCFs15ire34/TTevHac9SK8WXddN+80UbpDpODSd5z2qlIY7v82+nyluTO39li1mIxMKX8Jb/R8tbta/VI=&lQHIIB=UDOd2iazjyW
request POST http://www.poshkits.info/ogeb/
request GET http://www.poshkits.info/ogeb/?zS=AqRXXMRheGbbuzNJ7gUd3ELHirevyxJNjMj6aH1i+QGnsBV8j36ZsXkdOVofclXLXJuwnJ0etyY1DKNGveWcGaTGb3YRrubSnMygGeg=&lQHIIB=UDOd2iazjyW
request POST http://www.fstrainingllc.com/ogeb/
request POST http://www.ketocanadmqy.cloud/ogeb/
request POST http://www.gnhxxiazai03.com/ogeb/
request POST http://www.r1146.xyz/ogeb/
request POST http://www.drstephaniebest.com/ogeb/
request POST http://www.nicejunq.com/ogeb/
request POST http://www.fb99vn.com/ogeb/
request POST http://www.poshkits.info/ogeb/
request POST http://www.fstrainingllc.com/ogeb/
domain www.pymhn.top description Generic top level domain TLD
Time & API Arguments Status Return Repeated

NtAllocateVirtualMemory

 process_identifier: 296
region_size: 8192
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x02ea0000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 296
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x02ef0000
allocation_type: 12289 (MEM_COMMIT|MEM_RESERVE)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2148
region_size: 3158016
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x008d0000
allocation_type: 12288 (MEM_COMMIT|MEM_RESERVE)
process_handle: 0xffffffff
1 0 0
file C:\Users\test22\AppData\Local\Temp\nssBFE2.tmp\yxqaybnsjj.dll
file C:\Users\test22\AppData\Roaming\yenjsoxhcluqav\foktdy.exe
file C:\Users\test22\AppData\Local\Temp\nssBFE2.tmp\yxqaybnsjj.dll
file C:\Users\test22\AppData\Roaming\yenjsoxhcluqav\foktdy.exe
Time & API Arguments Status Return Repeated

LookupPrivilegeValueW

 system_name:
privilege_name: SeDebugPrivilege
1 1 0
host 84.54.50.66
reg_key HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run\ienwscl reg_value C:\Users\test22\AppData\Roaming\yenjsoxhcluqav\foktdy.exe "C:\Users\test22\AppData\Local\Temp\unsecapp.exe"
Process injection Process 296 called NtSetContextThread to modify thread in remote process 2148
Time & API Arguments Status Return Repeated

NtSetContextThread

 registers.eip: 2005598660
registers.esp: 1638384
registers.edi: 0
registers.eax: 4199136
registers.ebp: 0
registers.edx: 0
registers.ebx: 2130567168
registers.esi: 0
registers.ecx: 0
thread_handle: 0x0000021c
process_identifier: 2148
1 0 0
Bkav W32.AIDetectMalware
Lionic Trojan.Win32.Agent.tshg
Elastic malicious (high confidence)
MicroWorld-eScan Gen:Variant.Nemesis.22803
McAfee Artemis!D295211B783D
Malwarebytes Generic.Malware/Suspicious
Sangfor Suspicious.Win32.Save.ins
Cybereason malicious.b783d0
Arcabit Trojan.Nemesis.D5913 [many]
Cyren W32/Injector.BOF.gen!Eldorado
Symantec ML.Attribute.HighConfidence
ESET-NOD32 a variant of Win32/Injector.ETBA
APEX Malicious
Cynet Malicious (score: 100)
Kaspersky UDS:Trojan-Spy.Win32.Noon.gen
BitDefender Gen:Variant.Nemesis.22803
Avast FileRepMalware [Pws]
Emsisoft Gen:Variant.Nemesis.22803 (B)
VIPRE Gen:Variant.Nemesis.22803
McAfee-GW-Edition BehavesLike.Win32.Generic.dc
Trapmine malicious.moderate.ml.score
FireEye Generic.mg.d295211b783d0ef3
Sophos Mal/Generic-S
SentinelOne Static AI - Suspicious PE
Webroot W32.Malware.Gen
Microsoft Trojan:Win32/Formbook.AT!MTB
ZoneAlarm UDS:Trojan-Spy.Win32.Noon.gen
GData Zum.Androm.1
Google Detected
MAX malware (ai score=88)
Cylance unsafe
Rising Trojan.Avemariarat!8.11CB9 (TFE:6:M0iIpRjbqhI)
Ikarus Trojan.NSIS.Agent
Fortinet NSIS/Agent.DCAC!tr
AVG FileRepMalware [Pws]
DeepInstinct MALICIOUS
CrowdStrike win/malicious_confidence_100% (D)