Summary | ZeroBOX

Category	Machine	Started	Completed
FILE	s1_win7_x6403_us	June 20, 2023, 5:27 p.m.	June 20, 2023, 5:29 p.m.

Size	1.5MB
Type	PE32 executable (console) Intel 80386, for MS Windows
MD5	`c845efe0b7345f8a3bcfa5f7a5681b9b`
SHA256	`cb058d57e98615b394f8cdf007049b606781570cf7647b32cb7d100c651146d4`
CRC32	`032EF96D`
ssdeep	`24576:/U4bhPbuU5KSnXAW7WFasH3CJkFAsuWyTq+:cYhPFgSnwW5JkFBTf+`
Yara	UPX_Zero - UPX packed file OS_Processor_Check_Zero - OS Processor Check Malicious_Library_Zero - Malicious_Library Malicious_Packer_Zero - Malicious Packer PE_Header_Zero - PE File Signature IsPE32 - (no description)

Service64.exe "C:\Users\test22\AppData\Local\Temp\Service64.exe"
660
- InstallUtil.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe"
  2052

Name	Response	Post-Analysis Lookup
No hosts contacted.

IP Address	Status	Action
194.87.248.102	Active	Moloch

Suricata Alerts

Flow	SID	Signature	Category
TCP 192.168.56.103:49165 -> 194.87.248.102:3000	2031198	ET MALWARE Win32/HunterStealer/AlfonsoStealer/PhoenixStealer CnC Exfil	Malware Command and Control Activity Detected

Suricata TLS

No Suricata TLS

Command line console output was observed (23 events)

Time & API	Arguments	Status	Return
WriteConsoleA June 20, 2023, 5:27 p.m.	buffer: P console_handle: 0x00000007	1	1
WriteConsoleA June 20, 2023, 5:27 p.m.	buffer: e console_handle: 0x00000007	1	1
WriteConsoleA June 20, 2023, 5:27 p.m.	buffer: t console_handle: 0x00000007	1	1
WriteConsoleA June 20, 2023, 5:27 p.m.	buffer: e console_handle: 0x00000007	1	1
WriteConsoleA June 20, 2023, 5:27 p.m.	buffer: r console_handle: 0x00000007	1	1
WriteConsoleA June 20, 2023, 5:27 p.m.	buffer: s console_handle: 0x00000007	1	1
WriteConsoleA June 20, 2023, 5:27 p.m.	buffer: Auuenb92xnaw console_handle: 0x00000007	1	1
WriteConsoleA June 20, 2023, 5:27 p.m.	buffer: t console_handle: 0x00000007	1	1
WriteConsoleA June 20, 2023, 5:27 p.m.	buffer: a console_handle: 0x00000007	1	1
WriteConsoleA June 20, 2023, 5:27 p.m.	buffer: k console_handle: 0x00000007	1	1
WriteConsoleA June 20, 2023, 5:27 p.m.	buffer: e console_handle: 0x00000007	1	1
WriteConsoleA June 20, 2023, 5:27 p.m.	buffer: i console_handle: 0x00000007	1	1
WriteConsoleA June 20, 2023, 5:27 p.m.	buffer: t console_handle: 0x00000007	1	1
WriteConsoleA June 20, 2023, 5:27 p.m.	buffer: e console_handle: 0x00000007	1	1
WriteConsoleA June 20, 2023, 5:27 p.m.	buffer: v console_handle: 0x00000007	1	1
WriteConsoleA June 20, 2023, 5:27 p.m.	buffer: e console_handle: 0x00000007	1	1
WriteConsoleA June 20, 2023, 5:27 p.m.	buffer: r console_handle: 0x00000007	1	1
WriteConsoleA June 20, 2023, 5:27 p.m.	buffer: y console_handle: 0x00000007	1	1
WriteConsoleA June 20, 2023, 5:27 p.m.	buffer: w console_handle: 0x00000007	1	1
WriteConsoleA June 20, 2023, 5:27 p.m.	buffer: h console_handle: 0x00000007	1	1
WriteConsoleA June 20, 2023, 5:27 p.m.	buffer: e console_handle: 0x00000007	1	1
WriteConsoleA June 20, 2023, 5:27 p.m.	buffer: r console_handle: 0x00000007	1	1
WriteConsoleA June 20, 2023, 5:27 p.m.	buffer: e console_handle: 0x00000007	1	1

Checks amount of memory in system, this can be used to detect virtual machines that have a low amount of memory available (1 event)

Time & API	Arguments	Status	Return	Repeated
GlobalMemoryStatusEx June 20, 2023, 5:28 p.m.		1	1	0

The executable contains unknown PE section names indicative of a packer (could be a false positive) (1 event)

section

.switch

One or more potentially interesting buffers were extracted, these generally contain injected code, configuration data, etc.

Steals private information from local Internet browsers (50 out of 628 events)

file	C:\Users\test22\AppData\Local\Google\Chrome\User Data\Default\Sync Extension Settings
file	C:\Users\test22\AppData\Local\Google\Chrome\User Data\Default\Extensions\pkedcjkdefgpdelpbcmbmeomcjbeemfm\8620.824.0.0_0\_locales\ar
file	C:\Users\test22\AppData\Local\Google\Chrome\User Data\Default\Extensions\felcaaldnbdncclmgdcncolpebgiejap\1.2_0\_locales\ko
file	C:\Users\test22\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.47.0_0\_locales\fr
file	C:\Users\test22\AppData\Local\Google\Chrome\User Data\Default\Extensions\pkedcjkdefgpdelpbcmbmeomcjbeemfm\8620.824.0.0_0\_locales\am
file	C:\Users\test22\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.47.0_0\_locales\fi
file	C:\Users\test22\AppData\Local\Google\Chrome\User Data\Default\Extensions\apdfllckaahabafndbhieahigkjlhalf\14.5_0\_locales
file	C:\Users\test22\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.47.0_0\_locales\fa
file	C:\Users\test22\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.47.0_0\_locales\is
file	C:\Users\test22\AppData\Local\Google\Chrome\User Data\recovery\101.3.34.11\_metadata
file	C:\Users\test22\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.47.0_0\_locales\iw
file	C:\Users\test22\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.47.0_0\_locales\it
file	C:\Users\test22\AppData\Local\Google\Chrome\User Data\Crowd Deny
file	C:\Users\test22\AppData\Local\Google\Chrome\User Data\Default\Extensions\aohghmighlieiainnegkcijnfilokake\0.10_0\_locales\fil
file	C:\Users\test22\AppData\Local\Google\Chrome\User Data\Default\Extensions\pjkljhegncpnkpknbcohdijeoejaedia\8.3_0\_locales\de
file	C:\Users\test22\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.47.0_0\_locales\id
file	C:\Users\test22\AppData\Local\Google\Chrome\User Data\Default\Extensions\felcaaldnbdncclmgdcncolpebgiejap\1.2_0\_locales\fil
file	C:\Users\test22\AppData\Local\Google\Chrome\User Data\Default\Extensions\aapocclcgogkmnckokdopfmhonfmgoek\0.10_0\_locales\de
file	C:\Users\test22\AppData\Local\Google\Chrome\User Data\Default\Extensions\pkedcjkdefgpdelpbcmbmeomcjbeemfm\8620.824.0.0_0\_locales\nl
file	C:\Users\test22\AppData\Local\Google\Chrome\User Data\Default\Extensions\aapocclcgogkmnckokdopfmhonfmgoek\0.10_0\_locales\da
file	C:\Users\test22\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir
file	C:\Users\test22\AppData\Local\Google\Chrome\User Data\Default\Storage
file	C:\Users\test22\AppData\Local\Google\Chrome\User Data\Default\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo\4.2.8_0\_locales\sl
file	C:\Users\test22\AppData\Local\Google\Chrome\User Data\Default\Extensions
file	C:\Users\test22\AppData\Local\Google\Chrome\User Data\Default\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo\4.2.8_0\_locales\sk
file	C:\Users\test22\AppData\Local\Google\Chrome\User Data\ShaderCache
file	C:\Users\test22\AppData\Local\Google\Chrome\User Data\Default\Feature Engagement Tracker
file	C:\Users\test22\AppData\Local\Google\Chrome\User Data\Default\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo\4.2.8_0\_locales\sv
file	C:\Users\test22\AppData\Local\Google\Chrome\User Data\Default\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo\4.2.8_0\_locales\sr
file	C:\Users\test22\AppData\Local\Google\Chrome\User Data\FileTypePolicies\52
file	C:\Users\test22\AppData\Local\Google\Chrome\User Data\Default\JumpListIconsRecentClosed
file	C:\Users\test22\AppData\Local\Google\Chrome\User Data\Default\Download Service
file	C:\Users\test22\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda
file	C:\Users\test22\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales\es_419
file	C:\Users\test22\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales\zh_TW
file	C:\Users\test22\AppData\Local\Google\Chrome\User Data\WidevineCdm\4.10.2209.0\_platform_specific
file	C:\Users\test22\AppData\Local\Google\Chrome\User Data\CertificateTransparency\1256\_platform_specific\all\sths
file	C:\Users\test22\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\gfdkimpbcpahaombhbimeihdjnejgicl\def\GPUCache
file	C:\Users\test22\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales\vi
file	C:\Users\test22\AppData\Local\Google\Chrome\User Data\Crowd Deny\2021.8.2.1142
file	C:\Users\test22\AppData\Local\Google\Chrome\User Data\Default\Extensions\pkedcjkdefgpdelpbcmbmeomcjbeemfm\8620.824.0.0_0\_locales\fil
file	C:\Users\test22\AppData\Local\Google\Chrome\User Data\Default\Extensions\pjkljhegncpnkpknbcohdijeoejaedia\8.3_0\_locales\ja
file	C:\Users\test22\AppData\Local\Google\Chrome\User Data\ThirdPartyModuleList64\2018.8.8.0\_metadata
file	C:\Users\test22\AppData\Local\Google\Chrome\User Data\Default\Extensions\felcaaldnbdncclmgdcncolpebgiejap\1.2_0\_locales\lt
file	C:\Users\test22\AppData\Local\Google\Chrome\User Data\Default\Extensions\felcaaldnbdncclmgdcncolpebgiejap\1.2_0\_locales\lv
file	C:\Users\test22\AppData\Local\Google\Chrome\User Data\pnacl\0.57.44.2492\_platform_specific\x86_64
file	C:\Users\test22\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.47.0_0\_locales\pl
file	C:\Users\test22\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.47.0_0\_locales\pa
file	C:\Users\test22\AppData\Local\Google\Chrome\User Data\Default\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo\4.2.8_0\_locales\es
file	C:\Users\test22\AppData\Local\Google\Chrome\User Data\Default\Code Cache\wasm

Searches running processes potentially to identify processes for sandbox evasion, code injection or memory dumping (6 events)

Time & API	Arguments	Status	Return
Process32NextW June 20, 2023, 5:28 p.m.	snapshot_handle: 0x000000c0 process_name: pw.exe process_identifier: 1944	1	1
Process32NextW June 20, 2023, 5:28 p.m.	snapshot_handle: 0x000000c0 process_name: taskhost.exe process_identifier: 1984	1	1
Process32NextW June 20, 2023, 5:28 p.m.	snapshot_handle: 0x000000c0 process_name: SearchFilterHost.exe process_identifier: 516	1	1
Process32NextW June 20, 2023, 5:28 p.m.	snapshot_handle: 0x000000c0 process_name: svchost.exe process_identifier: 2304	1	1
Process32NextW June 20, 2023, 5:28 p.m.	snapshot_handle: 0x000000c0 process_name: mscorsvw.exe process_identifier: 2332	1	1
Process32NextW June 20, 2023, 5:28 p.m.	snapshot_handle: 0x000000c0 process_name: sppsvc.exe process_identifier: 2428	1	1

The binary likely contains encrypted or compressed data indicative of a packer (2 events)

section

{u'size_of_data': u'0x0009f200', u'virtual_address': u'0x00034000', u'entropy': 7.997434297154078, u'name': u'.data', u'virtual_size': u'0x000a00d8'}

entropy

7.99743429715

description

A section with a high entropy has been found

entropy

0.415877164325

description

Overall entropy of this PE file is high

Yara rule detected in process memory (10 events)

description	Communications over RAW Socket	rule	Network_TCP_Socket
description	(no description)	rule	DebuggerCheck__GlobalFlags
description	(no description)	rule	DebuggerCheck__QueryInfo
description	(no description)	rule	DebuggerHiding__Thread
description	(no description)	rule	DebuggerHiding__Active
description	(no description)	rule	ThreadControl__Context
description	(no description)	rule	SEH__vectored
description	Checks if being debugged	rule	anti_dbg
description	Bypass DEP	rule	disable_dep
description	Run a KeyLogger	rule	KeyLogger

Communicates with host for which no DNS query was performed (1 event)

host

194.87.248.102

Allocates execute permission to another process indicative of possible code injection (1 event)

Time & API	Arguments	Status	Return	Repeated
NtAllocateVirtualMemory June 20, 2023, 5:27 p.m.	process_identifier: 2052 region_size: 667648 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00400000 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0x0000002c	1	0	0

Attempts to access Bitcoin/ALTCoin wallets (2 events)

file	C:\wallet.dat
file	C:\Users\test22\AppData\Roaming\Electrum\wallets

Harvests credentials from local FTP client softwares (3 events)

file	C:\Users\test22\AppData\Roaming\GHISLER\wcx_ftp.ini
file	C:\Users\test22\AppData\Roaming\FileZilla\sitemanager.xml
file	C:\Users\test22\AppData\Roaming\FileZilla\recentservers.xml

Harvests credentials from local email clients (2 events)

file	C:\Users\test22\AppData\Local\Thunderbird\Profiles\hzkyl8yo.default
file	C:\Users\test22\AppData\Roaming\Thunderbird\Profiles\hzkyl8yo.default

Used NtSetContextThread to modify a thread in a remote process indicative of process injection (2 events)

Time & API	Arguments	Status	Return	Repeated
Process injection	Process 660 called NtSetContextThread to modify thread in remote process 2052
NtSetContextThread June 20, 2023, 5:27 p.m.	registers.eip: 2005598660 registers.esp: 1571648 registers.edi: 0 registers.eax: 4568584 registers.ebp: 0 registers.edx: 0 registers.ebx: 2130567168 registers.esi: 0 registers.ecx: 0 thread_handle: 0x00000020 process_identifier: 2052	1	0	0

Resumed a suspended thread in a remote process potentially indicative of process injection (2 events)

Time & API	Arguments	Status	Return	Repeated
Process injection	Process 660 resumed a thread in remote process 2052
NtResumeThread June 20, 2023, 5:27 p.m.	thread_handle: 0x00000020 suspend_count: 1 process_identifier: 2052	1	0	0

Executed a process and injected code into it, probably while unpacking (5 events)

Time & API	Arguments	Status	Return
CreateProcessInternalW June 20, 2023, 5:27 p.m.	thread_identifier: 2056 thread_handle: 0x00000020 process_identifier: 2052 current_directory: filepath: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe track: 1 command_line: filepath_r: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe stack_pivoted: 0 creation_flags: 4 (CREATE_SUSPENDED) inherit_handles: 0 process_handle: 0x0000002c	1	1
NtGetContextThread June 20, 2023, 5:27 p.m.	thread_handle: 0x00000020	1	0
NtAllocateVirtualMemory June 20, 2023, 5:27 p.m.	process_identifier: 2052 region_size: 667648 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00400000 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0x0000002c	1	0
NtSetContextThread June 20, 2023, 5:27 p.m.	registers.eip: 2005598660 registers.esp: 1571648 registers.edi: 0 registers.eax: 4568584 registers.ebp: 0 registers.edx: 0 registers.ebx: 2130567168 registers.esi: 0 registers.ecx: 0 thread_handle: 0x00000020 process_identifier: 2052	1	0
NtResumeThread June 20, 2023, 5:27 p.m.	thread_handle: 0x00000020 suspend_count: 1 process_identifier: 2052	1	0

File has been identified by 39 AntiVirus engines on VirusTotal as malicious (39 events)

Bkav	W32.AIDetectMalware
Lionic	Trojan.Win32.Generic.4!c
MicroWorld-eScan	Trojan.GenericKD.67634841
FireEye	Generic.mg.c845efe0b7345f8a
Sangfor	Trojan.Win32.Save.a
Alibaba	Trojan:Win32/Kryptik.e6dadb9d
Cybereason	malicious.8a11dc
BitDefenderTheta	Gen:NN.ZexaF.36250.FzW@aOz!p6hi
Symantec	ML.Attribute.HighConfidence
Elastic	malicious (high confidence)
ESET-NOD32	a variant of Win32/Kryptik.HTQR
APEX	Malicious
Cynet	Malicious (score: 100)
Kaspersky	HEUR:Trojan.Win32.Matanbuchus.gen
BitDefender	Trojan.GenericKD.67634841
Avast	Win32:Evo-gen [Trj]
Emsisoft	Trojan.GenericKD.67634841 (B)
F-Secure	Trojan.TR/Crypt.Agent.nandl
McAfee-GW-Edition	BehavesLike.Win32.Generic.tm
Trapmine	malicious.high.ml.score
Sophos	Mal/Generic-S
SentinelOne	Static AI - Malicious PE
Avira	TR/Crypt.Agent.nandl
MAX	malware (ai score=89)
Gridinsoft	Trojan.Win32.Gen.bot
Microsoft	Trojan:Win32/Wacatac.B!ml
ZoneAlarm	HEUR:Trojan.Win32.Matanbuchus.gen
GData	MSIL.Trojan-Stealer.CredStealer.D8MWR1
Google	Detected
AhnLab-V3	Trojan/Win.Generic.C5356966
McAfee	Artemis!C845EFE0B734
Cylance	unsafe
TrendMicro-HouseCall	TROJ_GEN.R002H0DFJ23
Rising	Spyware.Convagent!8.12330 (TFE:5:k8mANxEH1xD)
Ikarus	Trojan.Win32.Injector
Fortinet	W32/Injector.ESYR!tr
AVG	Win32:Evo-gen [Trj]
DeepInstinct	MALICIOUS
CrowdStrike	win/malicious_confidence_60% (W)

Service64.exe

Process Tree Toggle all

Network Toggle all

Suricata Toggle all

Suricata Alerts

Suricata TLS

Signatures Toggle All