popup
Summary | ZeroBOX
  1. Home
  2. Result
  3. Report
  4. Detail Analysis

lsass.exe

Formbook NSIS UPX Malicious Library PE File DLL OS Processor Check PE32
  1. Resubmit sample
Category Machine Started Completed
FILE s1_win7_x6401 June 20, 2023, 5:27 p.m. June 20, 2023, 5:36 p.m.
Size 265.9KB
Type PE32 executable (GUI) Intel 80386, for MS Windows, Nullsoft Installer self-extracting archive
MD5 fa24b7c4c3dc0c6d0b942eb96e4f18a0
SHA256 1fcaaed1008bcb79bbfac57a3927a03a8364ab00fce3080b2ea581116a6e8ba6
CRC32 2C7E2550
ssdeep 6144:/Ya6Id9xfmNNjisQm9E/WtwQ4OBXLY/GOwq6q1IDgFhfaoew3:/Y+3xfmN2sQUKQDXL0q8ICB3
Yara
  • UPX_Zero - UPX packed file
  • Malicious_Library_Zero - Malicious_Library
  • NSIS_Installer - Null Soft Installer
  • PE_Header_Zero - PE File Signature
  • IsPE32 - (no description)

Suricata Alerts

Flow SID Signature Category
UDP 192.168.56.101:54883 -> 164.124.101.2:53 2023883 ET DNS Query to a *.top domain - Likely Hostile Potentially Bad Traffic
TCP 192.168.56.101:49179 -> 162.0.231.6:80 2031412 ET MALWARE FormBook CnC Checkin (GET) Malware Command and Control Activity Detected
TCP 192.168.56.101:49179 -> 162.0.231.6:80 2031449 ET MALWARE FormBook CnC Checkin (GET) Malware Command and Control Activity Detected
TCP 192.168.56.101:49191 -> 172.67.185.242:80 2031412 ET MALWARE FormBook CnC Checkin (GET) Malware Command and Control Activity Detected
TCP 192.168.56.101:49179 -> 162.0.231.6:80 2031453 ET MALWARE FormBook CnC Checkin (GET) Malware Command and Control Activity Detected
TCP 192.168.56.101:49191 -> 172.67.185.242:80 2031449 ET MALWARE FormBook CnC Checkin (GET) Malware Command and Control Activity Detected
TCP 192.168.56.101:49191 -> 172.67.185.242:80 2031453 ET MALWARE FormBook CnC Checkin (GET) Malware Command and Control Activity Detected
TCP 192.168.56.101:49177 -> 104.21.12.203:80 2031412 ET MALWARE FormBook CnC Checkin (GET) Malware Command and Control Activity Detected
TCP 192.168.56.101:49177 -> 104.21.12.203:80 2031449 ET MALWARE FormBook CnC Checkin (GET) Malware Command and Control Activity Detected
TCP 192.168.56.101:49177 -> 104.21.12.203:80 2031453 ET MALWARE FormBook CnC Checkin (GET) Malware Command and Control Activity Detected
TCP 192.168.56.101:49171 -> 172.67.203.63:80 2031412 ET MALWARE FormBook CnC Checkin (GET) Malware Command and Control Activity Detected
TCP 192.168.56.101:49171 -> 172.67.203.63:80 2031449 ET MALWARE FormBook CnC Checkin (GET) Malware Command and Control Activity Detected
TCP 192.168.56.101:49169 -> 20.255.200.185:80 2031412 ET MALWARE FormBook CnC Checkin (GET) Malware Command and Control Activity Detected
TCP 192.168.56.101:49171 -> 172.67.203.63:80 2031453 ET MALWARE FormBook CnC Checkin (GET) Malware Command and Control Activity Detected
TCP 192.168.56.101:49169 -> 20.255.200.185:80 2031449 ET MALWARE FormBook CnC Checkin (GET) Malware Command and Control Activity Detected
TCP 192.168.56.101:49171 -> 172.67.203.63:80 2031088 ET HUNTING Request to .XYZ Domain with Minimal Headers Potentially Bad Traffic
TCP 192.168.56.101:49169 -> 20.255.200.185:80 2031453 ET MALWARE FormBook CnC Checkin (GET) Malware Command and Control Activity Detected
TCP 192.168.56.101:49183 -> 84.32.84.32:80 2031412 ET MALWARE FormBook CnC Checkin (GET) Malware Command and Control Activity Detected
TCP 192.168.56.101:49183 -> 84.32.84.32:80 2031449 ET MALWARE FormBook CnC Checkin (GET) Malware Command and Control Activity Detected
TCP 192.168.56.101:49183 -> 84.32.84.32:80 2031453 ET MALWARE FormBook CnC Checkin (GET) Malware Command and Control Activity Detected
TCP 192.168.56.101:49175 -> 91.195.240.123:80 2031412 ET MALWARE FormBook CnC Checkin (GET) Malware Command and Control Activity Detected
TCP 192.168.56.101:49175 -> 91.195.240.123:80 2031449 ET MALWARE FormBook CnC Checkin (GET) Malware Command and Control Activity Detected
TCP 192.168.56.101:49175 -> 91.195.240.123:80 2031453 ET MALWARE FormBook CnC Checkin (GET) Malware Command and Control Activity Detected
TCP 192.168.56.101:49181 -> 154.39.174.239:80 2031412 ET MALWARE FormBook CnC Checkin (GET) Malware Command and Control Activity Detected
TCP 192.168.56.101:49181 -> 154.39.174.239:80 2031449 ET MALWARE FormBook CnC Checkin (GET) Malware Command and Control Activity Detected
TCP 192.168.56.101:49181 -> 154.39.174.239:80 2031453 ET MALWARE FormBook CnC Checkin (GET) Malware Command and Control Activity Detected
TCP 192.168.56.101:49166 -> 195.161.62.100:80 2031412 ET MALWARE FormBook CnC Checkin (GET) Malware Command and Control Activity Detected
TCP 192.168.56.101:49173 -> 198.185.159.145:80 2031412 ET MALWARE FormBook CnC Checkin (GET) Malware Command and Control Activity Detected
TCP 192.168.56.101:49166 -> 195.161.62.100:80 2031449 ET MALWARE FormBook CnC Checkin (GET) Malware Command and Control Activity Detected
TCP 192.168.56.101:49173 -> 198.185.159.145:80 2031449 ET MALWARE FormBook CnC Checkin (GET) Malware Command and Control Activity Detected
TCP 192.168.56.101:49166 -> 195.161.62.100:80 2031453 ET MALWARE FormBook CnC Checkin (GET) Malware Command and Control Activity Detected
TCP 192.168.56.101:49173 -> 198.185.159.145:80 2031453 ET MALWARE FormBook CnC Checkin (GET) Malware Command and Control Activity Detected

Suricata TLS

No Suricata TLS

Time & API Arguments Status Return Repeated

GlobalMemoryStatusEx

 1 1 0
section .ndata
suspicious_features GET method with no useragent header suspicious_request GET http://www.ketocanadmqy.cloud/ogeb/?STILiOsC=JCW7LwLHnn7ptjGjE5oXohZmdFlQQ26ARwAmaoNxO6ijvQN7ubUT60jiWusc3p3YeBdlnORuW+NtBTBOf6MBl7CRUR/NRW0MRl+FZL4=&kvoc=Jnm0rJMacH
suspicious_features GET method with no useragent header suspicious_request GET http://www.gnhxxiazai03.com/ogeb/?STILiOsC=wBih4ktWfPNsySsqn3uI1HmQOkxE78XnlLTDvxJFz8Ksfyo9cnxjh72KIWiVUUXAXHwdyJ5YpLQGYf4Z+A02Vjn9hAcAu81BvwPbwlI=&kvoc=Jnm0rJMacH
suspicious_features GET method with no useragent header suspicious_request GET http://www.r1146.xyz/ogeb/?STILiOsC=hQC9FzST15eBXJ4J4T0DlrZN3V4nndOGJI8rCOq0KQaVihaPabvY2aUaE4N/PK/Cku54qUwIUhcWHwQfhhinhH5BJGjDnxoo3iDp4OU=&kvoc=Jnm0rJMacH
suspicious_features GET method with no useragent header suspicious_request GET http://www.drstephaniebest.com/ogeb/?STILiOsC=+v0OuBHGG6cw5ZwrQCjmtsYbU4xaGL5HoMfXaXw9oSi2F/e6KL+7wkfrHW9mkq7nBIGbSiwCyL8lMMQd9mW+kFWaqBx5WK5Isw5ml80=&kvoc=Jnm0rJMacH
suspicious_features GET method with no useragent header suspicious_request GET http://www.nicejunq.com/ogeb/?STILiOsC=61GncP3LZGSS1NuGOhw0w9YAjVqrgaXoImnMpoqiHfpClz+VkHF1OaSSbCiQjyR+WlMAeIDV0LjpJ/XsdXKhboCqPvNVkna3o/MBoBk=&kvoc=Jnm0rJMacH
suspicious_features GET method with no useragent header suspicious_request GET http://www.fb99vn.com/ogeb/?STILiOsC=OXN+k+OlhXjl96bKh2NTgPCFs15ire34/TTevHac9SK8WXddN+80UbpDpODSd5z2qlIY7v82+nyluTO39li1mIxMKX8Jb/R8tbta/VI=&kvoc=Jnm0rJMacH
suspicious_features GET method with no useragent header suspicious_request GET http://www.poshkits.info/ogeb/?STILiOsC=AqRXXMRheGbbuzNJ7gUd3ELHirevyxJNjMj6aH1i+QGnsBV8j36ZsXkdOVofclXLXJuwnJ0etyY1DKNGveWcGaTGb3YRrubSnMygGeg=&kvoc=Jnm0rJMacH
suspicious_features GET method with no useragent header suspicious_request GET http://www.fstrainingllc.com/ogeb/?STILiOsC=3AILmDJPkAUUrpOG/VIeUrZXgpOSZo6R/tiWoTcNtPioWsJTZGZ4drzV2BWU9NJm5Ofj96iGCfDOoWGqNQZdTpxyILTH4aD/oQaBOA8=&kvoc=Jnm0rJMacH
suspicious_features GET method with no useragent header suspicious_request GET http://www.visitel.shop/ogeb/?STILiOsC=JmLU2mTBWsrOHDUrIsVZgtVQRaelVRuf6+I2Xs1ZEo8rZrv8bAAW18MTALrdbAN3gfqX7mOUKpSKY+XC5VOAaGGHACr1P6ttQJNqQi0=&kvoc=Jnm0rJMacH
suspicious_features GET method with no useragent header suspicious_request GET http://www.cracksoftwaresite.com/ogeb/?STILiOsC=KHI+YMON8GDkJzoILZCxgp2k0vA8qk8w1nm3Hzfxt5cieIBSKAQj/mHyTxk04gzaD6SR3s2U41jQ75g96W4nWpYWemp5ZS7oMYAdX5g=&kvoc=Jnm0rJMacH
request POST http://www.ketocanadmqy.cloud/ogeb/
request GET http://www.ketocanadmqy.cloud/ogeb/?STILiOsC=JCW7LwLHnn7ptjGjE5oXohZmdFlQQ26ARwAmaoNxO6ijvQN7ubUT60jiWusc3p3YeBdlnORuW+NtBTBOf6MBl7CRUR/NRW0MRl+FZL4=&kvoc=Jnm0rJMacH
request GET http://www.sqlite.org/2016/sqlite-dll-win32-x86-3130000.zip
request POST http://www.gnhxxiazai03.com/ogeb/
request GET http://www.gnhxxiazai03.com/ogeb/?STILiOsC=wBih4ktWfPNsySsqn3uI1HmQOkxE78XnlLTDvxJFz8Ksfyo9cnxjh72KIWiVUUXAXHwdyJ5YpLQGYf4Z+A02Vjn9hAcAu81BvwPbwlI=&kvoc=Jnm0rJMacH
request POST http://www.r1146.xyz/ogeb/
request GET http://www.r1146.xyz/ogeb/?STILiOsC=hQC9FzST15eBXJ4J4T0DlrZN3V4nndOGJI8rCOq0KQaVihaPabvY2aUaE4N/PK/Cku54qUwIUhcWHwQfhhinhH5BJGjDnxoo3iDp4OU=&kvoc=Jnm0rJMacH
request POST http://www.drstephaniebest.com/ogeb/
request GET http://www.drstephaniebest.com/ogeb/?STILiOsC=+v0OuBHGG6cw5ZwrQCjmtsYbU4xaGL5HoMfXaXw9oSi2F/e6KL+7wkfrHW9mkq7nBIGbSiwCyL8lMMQd9mW+kFWaqBx5WK5Isw5ml80=&kvoc=Jnm0rJMacH
request POST http://www.nicejunq.com/ogeb/
request GET http://www.nicejunq.com/ogeb/?STILiOsC=61GncP3LZGSS1NuGOhw0w9YAjVqrgaXoImnMpoqiHfpClz+VkHF1OaSSbCiQjyR+WlMAeIDV0LjpJ/XsdXKhboCqPvNVkna3o/MBoBk=&kvoc=Jnm0rJMacH
request POST http://www.fb99vn.com/ogeb/
request GET http://www.fb99vn.com/ogeb/?STILiOsC=OXN+k+OlhXjl96bKh2NTgPCFs15ire34/TTevHac9SK8WXddN+80UbpDpODSd5z2qlIY7v82+nyluTO39li1mIxMKX8Jb/R8tbta/VI=&kvoc=Jnm0rJMacH
request POST http://www.poshkits.info/ogeb/
request GET http://www.poshkits.info/ogeb/?STILiOsC=AqRXXMRheGbbuzNJ7gUd3ELHirevyxJNjMj6aH1i+QGnsBV8j36ZsXkdOVofclXLXJuwnJ0etyY1DKNGveWcGaTGb3YRrubSnMygGeg=&kvoc=Jnm0rJMacH
request POST http://www.fstrainingllc.com/ogeb/
request GET http://www.fstrainingllc.com/ogeb/?STILiOsC=3AILmDJPkAUUrpOG/VIeUrZXgpOSZo6R/tiWoTcNtPioWsJTZGZ4drzV2BWU9NJm5Ofj96iGCfDOoWGqNQZdTpxyILTH4aD/oQaBOA8=&kvoc=Jnm0rJMacH
request POST http://www.visitel.shop/ogeb/
request GET http://www.visitel.shop/ogeb/?STILiOsC=JmLU2mTBWsrOHDUrIsVZgtVQRaelVRuf6+I2Xs1ZEo8rZrv8bAAW18MTALrdbAN3gfqX7mOUKpSKY+XC5VOAaGGHACr1P6ttQJNqQi0=&kvoc=Jnm0rJMacH
request POST http://www.cracksoftwaresite.com/ogeb/
request GET http://www.cracksoftwaresite.com/ogeb/?STILiOsC=KHI+YMON8GDkJzoILZCxgp2k0vA8qk8w1nm3Hzfxt5cieIBSKAQj/mHyTxk04gzaD6SR3s2U41jQ75g96W4nWpYWemp5ZS7oMYAdX5g=&kvoc=Jnm0rJMacH
request POST http://www.ketocanadmqy.cloud/ogeb/
request POST http://www.gnhxxiazai03.com/ogeb/
request POST http://www.r1146.xyz/ogeb/
request POST http://www.drstephaniebest.com/ogeb/
request POST http://www.nicejunq.com/ogeb/
request POST http://www.fb99vn.com/ogeb/
request POST http://www.poshkits.info/ogeb/
request POST http://www.fstrainingllc.com/ogeb/
request POST http://www.visitel.shop/ogeb/
request POST http://www.cracksoftwaresite.com/ogeb/
Time & API Arguments Status Return Repeated

NtProtectVirtualMemory

 process_identifier: 2680
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x732a2000
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2680
region_size: 8192
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x02f90000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2680
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x03020000
allocation_type: 12289 (MEM_COMMIT|MEM_RESERVE)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2788
region_size: 3158016
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x00a00000
allocation_type: 12288 (MEM_COMMIT|MEM_RESERVE)
process_handle: 0xffffffff
1 0 0
file C:\Users\test22\AppData\Local\Temp\nsnF34B.tmp\xrlrshqq.dll
file C:\Users\test22\AppData\Local\Temp\nsnF34B.tmp\xrlrshqq.dll
Time & API Arguments Status Return Repeated

LookupPrivilegeValueW

 system_name:
privilege_name: SeDebugPrivilege
1 1 0
Process injection Process 2680 called NtSetContextThread to modify thread in remote process 2788
Time & API Arguments Status Return Repeated

NtSetContextThread

 registers.eip: 1995571652
registers.esp: 1638384
registers.edi: 0
registers.eax: 4199136
registers.ebp: 0
registers.edx: 0
registers.ebx: 2130567168
registers.esi: 0
registers.ecx: 0
thread_handle: 0x0000021c
process_identifier: 2788
1 0 0
Time & API Arguments Status Return Repeated

CreateProcessInternalW

 thread_identifier: 2792
thread_handle: 0x0000021c
process_identifier: 2788
current_directory:
filepath: C:\Users\test22\AppData\Local\Temp\lsass.exe
track: 1
command_line:
filepath_r: C:\Users\test22\AppData\Local\Temp\lsass.exe
stack_pivoted: 0
creation_flags: 134217732 (CREATE_NO_WINDOW|CREATE_SUSPENDED)
inherit_handles: 0
process_handle: 0x00000220
1 1 0
Bkav W32.AIDetectMalware
Lionic Trojan.Win32.Agent.tshg
Elastic malicious (high confidence)
MicroWorld-eScan Gen:Variant.Nemesis.22774
FireEye Generic.mg.fa24b7c4c3dc0c6d
CAT-QuickHeal Trojan.Avemariarat
McAfee Artemis!FA24B7C4C3DC
Malwarebytes Trojan.Loader
Sangfor Suspicious.Win32.Save.ins
K7AntiVirus Trojan ( 005a6c251 )
Alibaba Trojan:Application/Generic.acb3471c
K7GW Trojan ( 005a6c251 )
Cybereason malicious.4c3dc0
Arcabit Trojan.Nemesis.D58F6 [many]
VirIT Trojan.Win32.Genus.RHT
Cyren W32/ABRisk.QHLS-5482
Symantec ML.Attribute.HighConfidence
ESET-NOD32 a variant of Win32/Injector.ETAW
APEX Malicious
Cynet Malicious (score: 100)
Kaspersky HEUR:Trojan-Spy.Win32.Noon.gen
BitDefender Gen:Variant.Nemesis.22774
Avast Win32:InjectorX-gen [Trj]
Tencent Win32.Trojan-Spy.Noon.Anhl
Sophos Mal/Generic-S
F-Secure Trojan.TR/Redcap.jxawb
VIPRE Gen:Variant.Nemesis.22774
TrendMicro TROJ_GEN.R002C0DFJ23
McAfee-GW-Edition BehavesLike.Win32.Generic.dc
Trapmine malicious.moderate.ml.score
Emsisoft Gen:Variant.Nemesis.22774 (B)
SentinelOne Static AI - Suspicious PE
Avira TR/AD.GenShell.hswgb
MAX malware (ai score=85)
Antiy-AVL Trojan/Win32.Injector
Microsoft Trojan:Win32/Leonem
ZoneAlarm HEUR:Trojan-Spy.Win32.Noon.gen
GData Zum.Androm.1
Google Detected
AhnLab-V3 Trojan/Win.Generic.R585815
Cylance unsafe
Panda Trj/GdSda.A
TrendMicro-HouseCall TROJ_GEN.R002C0DFJ23
Rising Trojan.Injector!8.C4 (TFE:6:I3RwG4Ux51M)
Yandex Trojan.Injector!CMkfvt0VUfA
Ikarus Trojan.Win32.Injector
Fortinet NSIS/Agent.DCAC!tr
AVG Win32:InjectorX-gen [Trj]
DeepInstinct MALICIOUS
CrowdStrike win/malicious_confidence_100% (W)