popup
Summary | ZeroBOX
  1. Home
  2. Result
  3. Report
  4. Detail Analysis

unsecapp.exe

Formbook NSIS UPX Malicious Library PE File DLL OS Processor Check PE32
  1. Resubmit sample
Category Machine Started Completed
FILE s1_win7_x6403_us June 21, 2023, 4:01 p.m. June 21, 2023, 4:04 p.m.
Size 285.4KB
Type PE32 executable (GUI) Intel 80386, for MS Windows, Nullsoft Installer self-extracting archive
MD5 297c423d2a4a52a7f109240ae70b4ca1
SHA256 ab0646fd7bf8dece42e0c38e843fbe4cbb9c18e0e98cb26cad14357fde20ed4a
CRC32 7DC7C699
ssdeep 6144:PYa6ZqAP7zUPusAHp0X94+O/kcw0u4vEEMLwdToNvrj5jcB4H6:PYLq0zcAHpa945fw4M81ugBB
Yara
  • UPX_Zero - UPX packed file
  • NSIS_Installer - Null Soft Installer
  • PE_Header_Zero - PE File Signature
  • Malicious_Library_Zero - Malicious_Library
  • IsPE32 - (no description)

Suricata Alerts

Flow SID Signature Category
UDP 192.168.56.103:62576 -> 164.124.101.2:53 2023883 ET DNS Query to a *.top domain - Likely Hostile Potentially Bad Traffic
TCP 192.168.56.103:49168 -> 20.255.200.185:80 2031413 ET MALWARE FormBook CnC Checkin (POST) M2 Malware Command and Control Activity Detected
TCP 192.168.56.103:49174 -> 198.185.159.145:80 2031413 ET MALWARE FormBook CnC Checkin (POST) M2 Malware Command and Control Activity Detected
TCP 192.168.56.103:49186 -> 154.39.174.239:80 2031413 ET MALWARE FormBook CnC Checkin (POST) M2 Malware Command and Control Activity Detected
TCP 192.168.56.103:49183 -> 162.0.231.6:80 2031413 ET MALWARE FormBook CnC Checkin (POST) M2 Malware Command and Control Activity Detected
TCP 192.168.56.103:49177 -> 91.195.240.123:80 2031413 ET MALWARE FormBook CnC Checkin (POST) M2 Malware Command and Control Activity Detected
TCP 192.168.56.103:49182 -> 104.21.12.203:80 2031412 ET MALWARE FormBook CnC Checkin (GET) Malware Command and Control Activity Detected
TCP 192.168.56.103:49182 -> 104.21.12.203:80 2031449 ET MALWARE FormBook CnC Checkin (GET) Malware Command and Control Activity Detected
TCP 192.168.56.103:49182 -> 104.21.12.203:80 2031453 ET MALWARE FormBook CnC Checkin (GET) Malware Command and Control Activity Detected
TCP 192.168.56.103:49179 -> 91.195.240.123:80 2031412 ET MALWARE FormBook CnC Checkin (GET) Malware Command and Control Activity Detected
TCP 192.168.56.103:49171 -> 172.67.203.63:80 2031413 ET MALWARE FormBook CnC Checkin (POST) M2 Malware Command and Control Activity Detected
TCP 192.168.56.103:49179 -> 91.195.240.123:80 2031449 ET MALWARE FormBook CnC Checkin (GET) Malware Command and Control Activity Detected
TCP 192.168.56.103:49179 -> 91.195.240.123:80 2031453 ET MALWARE FormBook CnC Checkin (GET) Malware Command and Control Activity Detected
TCP 192.168.56.103:49173 -> 172.67.203.63:80 2031412 ET MALWARE FormBook CnC Checkin (GET) Malware Command and Control Activity Detected
TCP 192.168.56.103:49173 -> 172.67.203.63:80 2031449 ET MALWARE FormBook CnC Checkin (GET) Malware Command and Control Activity Detected
TCP 192.168.56.103:49173 -> 172.67.203.63:80 2031453 ET MALWARE FormBook CnC Checkin (GET) Malware Command and Control Activity Detected
TCP 192.168.56.103:49173 -> 172.67.203.63:80 2031088 ET HUNTING Request to .XYZ Domain with Minimal Headers Potentially Bad Traffic
TCP 192.168.56.103:49180 -> 104.21.12.203:80 2031413 ET MALWARE FormBook CnC Checkin (POST) M2 Malware Command and Control Activity Detected
TCP 192.168.56.103:49170 -> 20.255.200.185:80 2031412 ET MALWARE FormBook CnC Checkin (GET) Malware Command and Control Activity Detected
TCP 192.168.56.103:49170 -> 20.255.200.185:80 2031449 ET MALWARE FormBook CnC Checkin (GET) Malware Command and Control Activity Detected
TCP 192.168.56.103:49185 -> 162.0.231.6:80 2031412 ET MALWARE FormBook CnC Checkin (GET) Malware Command and Control Activity Detected
TCP 192.168.56.103:49170 -> 20.255.200.185:80 2031453 ET MALWARE FormBook CnC Checkin (GET) Malware Command and Control Activity Detected
TCP 192.168.56.103:49185 -> 162.0.231.6:80 2031449 ET MALWARE FormBook CnC Checkin (GET) Malware Command and Control Activity Detected
TCP 192.168.56.103:49185 -> 162.0.231.6:80 2031453 ET MALWARE FormBook CnC Checkin (GET) Malware Command and Control Activity Detected
TCP 192.168.56.103:49176 -> 198.185.159.145:80 2031412 ET MALWARE FormBook CnC Checkin (GET) Malware Command and Control Activity Detected
TCP 192.168.56.103:49176 -> 198.185.159.145:80 2031449 ET MALWARE FormBook CnC Checkin (GET) Malware Command and Control Activity Detected
TCP 192.168.56.103:49176 -> 198.185.159.145:80 2031453 ET MALWARE FormBook CnC Checkin (GET) Malware Command and Control Activity Detected
TCP 192.168.56.103:49166 -> 195.161.62.100:80 2031412 ET MALWARE FormBook CnC Checkin (GET) Malware Command and Control Activity Detected
TCP 192.168.56.103:49166 -> 195.161.62.100:80 2031449 ET MALWARE FormBook CnC Checkin (GET) Malware Command and Control Activity Detected
TCP 192.168.56.103:49166 -> 195.161.62.100:80 2031453 ET MALWARE FormBook CnC Checkin (GET) Malware Command and Control Activity Detected
TCP 192.168.56.103:49195 -> 154.39.174.239:80 2031412 ET MALWARE FormBook CnC Checkin (GET) Malware Command and Control Activity Detected
TCP 192.168.56.103:49195 -> 154.39.174.239:80 2031449 ET MALWARE FormBook CnC Checkin (GET) Malware Command and Control Activity Detected
TCP 192.168.56.103:49195 -> 154.39.174.239:80 2031453 ET MALWARE FormBook CnC Checkin (GET) Malware Command and Control Activity Detected

Suricata TLS

No Suricata TLS

Time & API Arguments Status Return Repeated

GlobalMemoryStatusEx

 1 1 0
section .ndata
suspicious_features GET method with no useragent header suspicious_request GET http://www.ketocanadmqy.cloud/ogeb/?jn=JCW7LwLHnn7ptjGjE5oXohZmdFlQQ26ARwAmaoNxO6ijvQN7ubUT60jiWusc3p3YeBdlnORuW+NtBTBOf6MBl7CRUR/NRW0MRl+FZL4=&q2hFh=SZfKrZcS
suspicious_features GET method with no useragent header suspicious_request GET http://www.gnhxxiazai03.com/ogeb/?jn=wBih4ktWfPNsySsqn3uI1HmQOkxE78XnlLTDvxJFz8Ksfyo9cnxjh72KIWiVUUXAXHwdyJ5YpLQGYf4Z+A02Vjn9hAcAu81BvwPbwlI=&q2hFh=SZfKrZcS
suspicious_features GET method with no useragent header suspicious_request GET http://www.r1146.xyz/ogeb/?jn=hQC9FzST15eBXJ4J4T0DlrZN3V4nndOGJI8rCOq0KQaVihaPabvY2aUaE4N/PK/Cku54qUwIUhcWHwQfhhinhH5BJGjDnxoo3iDp4OU=&q2hFh=SZfKrZcS
suspicious_features GET method with no useragent header suspicious_request GET http://www.drstephaniebest.com/ogeb/?jn=+v0OuBHGG6cw5ZwrQCjmtsYbU4xaGL5HoMfXaXw9oSi2F/e6KL+7wkfrHW9mkq7nBIGbSiwCyL8lMMQd9mW+kFWaqBx5WK5Isw5ml80=&q2hFh=SZfKrZcS
suspicious_features GET method with no useragent header suspicious_request GET http://www.nicejunq.com/ogeb/?jn=61GncP3LZGSS1NuGOhw0w9YAjVqrgaXoImnMpoqiHfpClz+VkHF1OaSSbCiQjyR+WlMAeIDV0LjpJ/XsdXKhboCqPvNVkna3o/MBoBk=&q2hFh=SZfKrZcS
suspicious_features GET method with no useragent header suspicious_request GET http://www.fb99vn.com/ogeb/?jn=OXN+k+OlhXjl96bKh2NTgPCFs15ire34/TTevHac9SK8WXddN+80UbpDpODSd5z2qlIY7v82+nyluTO39li1mIxMKX8Jb/R8tbta/VI=&q2hFh=SZfKrZcS
suspicious_features GET method with no useragent header suspicious_request GET http://www.poshkits.info/ogeb/?jn=AqRXXMRheGbbuzNJ7gUd3ELHirevyxJNjMj6aH1i+QGnsBV8j36ZsXkdOVofclXLXJuwnJ0etyY1DKNGveWcGaTGb3YRrubSnMygGeg=&q2hFh=SZfKrZcS
suspicious_features GET method with no useragent header suspicious_request GET http://www.fstrainingllc.com/ogeb/?jn=3AILmDJPkAUUrpOG/VIeUrZXgpOSZo6R/tiWoTcNtPioWsJTZGZ4drzV2BWU9NJm5Ofj96iGCfDOoWGqNQZdTpxyILTH4aD/oQaBOA8=&q2hFh=SZfKrZcS
request POST http://www.ketocanadmqy.cloud/ogeb/
request GET http://www.ketocanadmqy.cloud/ogeb/?jn=JCW7LwLHnn7ptjGjE5oXohZmdFlQQ26ARwAmaoNxO6ijvQN7ubUT60jiWusc3p3YeBdlnORuW+NtBTBOf6MBl7CRUR/NRW0MRl+FZL4=&q2hFh=SZfKrZcS
request GET http://www.sqlite.org/2018/sqlite-dll-win32-x86-3220000.zip
request POST http://www.gnhxxiazai03.com/ogeb/
request GET http://www.gnhxxiazai03.com/ogeb/?jn=wBih4ktWfPNsySsqn3uI1HmQOkxE78XnlLTDvxJFz8Ksfyo9cnxjh72KIWiVUUXAXHwdyJ5YpLQGYf4Z+A02Vjn9hAcAu81BvwPbwlI=&q2hFh=SZfKrZcS
request POST http://www.r1146.xyz/ogeb/
request GET http://www.r1146.xyz/ogeb/?jn=hQC9FzST15eBXJ4J4T0DlrZN3V4nndOGJI8rCOq0KQaVihaPabvY2aUaE4N/PK/Cku54qUwIUhcWHwQfhhinhH5BJGjDnxoo3iDp4OU=&q2hFh=SZfKrZcS
request POST http://www.drstephaniebest.com/ogeb/
request GET http://www.drstephaniebest.com/ogeb/?jn=+v0OuBHGG6cw5ZwrQCjmtsYbU4xaGL5HoMfXaXw9oSi2F/e6KL+7wkfrHW9mkq7nBIGbSiwCyL8lMMQd9mW+kFWaqBx5WK5Isw5ml80=&q2hFh=SZfKrZcS
request POST http://www.nicejunq.com/ogeb/
request GET http://www.nicejunq.com/ogeb/?jn=61GncP3LZGSS1NuGOhw0w9YAjVqrgaXoImnMpoqiHfpClz+VkHF1OaSSbCiQjyR+WlMAeIDV0LjpJ/XsdXKhboCqPvNVkna3o/MBoBk=&q2hFh=SZfKrZcS
request POST http://www.fb99vn.com/ogeb/
request GET http://www.fb99vn.com/ogeb/?jn=OXN+k+OlhXjl96bKh2NTgPCFs15ire34/TTevHac9SK8WXddN+80UbpDpODSd5z2qlIY7v82+nyluTO39li1mIxMKX8Jb/R8tbta/VI=&q2hFh=SZfKrZcS
request POST http://www.poshkits.info/ogeb/
request GET http://www.poshkits.info/ogeb/?jn=AqRXXMRheGbbuzNJ7gUd3ELHirevyxJNjMj6aH1i+QGnsBV8j36ZsXkdOVofclXLXJuwnJ0etyY1DKNGveWcGaTGb3YRrubSnMygGeg=&q2hFh=SZfKrZcS
request POST http://www.fstrainingllc.com/ogeb/
request GET http://www.fstrainingllc.com/ogeb/?jn=3AILmDJPkAUUrpOG/VIeUrZXgpOSZo6R/tiWoTcNtPioWsJTZGZ4drzV2BWU9NJm5Ofj96iGCfDOoWGqNQZdTpxyILTH4aD/oQaBOA8=&q2hFh=SZfKrZcS
request POST http://www.ketocanadmqy.cloud/ogeb/
request POST http://www.gnhxxiazai03.com/ogeb/
request POST http://www.r1146.xyz/ogeb/
request POST http://www.drstephaniebest.com/ogeb/
request POST http://www.nicejunq.com/ogeb/
request POST http://www.fb99vn.com/ogeb/
request POST http://www.poshkits.info/ogeb/
request POST http://www.fstrainingllc.com/ogeb/
Time & API Arguments Status Return Repeated

NtAllocateVirtualMemory

 process_identifier: 1900
region_size: 8192
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x02dc0000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 1900
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x02dd0000
allocation_type: 12289 (MEM_COMMIT|MEM_RESERVE)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2064
region_size: 3158016
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x00920000
allocation_type: 12288 (MEM_COMMIT|MEM_RESERVE)
process_handle: 0xffffffff
1 0 0
file C:\Users\test22\AppData\Local\Temp\nsjC011.tmp\apeuke.dll
file C:\Users\test22\AppData\Roaming\yenjsoxhcluqav\foktdy.exe
file C:\Users\test22\AppData\Local\Temp\nsjC011.tmp\apeuke.dll
file C:\Users\test22\AppData\Roaming\yenjsoxhcluqav\foktdy.exe
Time & API Arguments Status Return Repeated

LookupPrivilegeValueW

 system_name:
privilege_name: SeDebugPrivilege
1 1 0
reg_key HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run\ienwscl reg_value C:\Users\test22\AppData\Roaming\yenjsoxhcluqav\foktdy.exe "C:\Users\test22\AppData\Local\Temp\unsecapp.exe"
Process injection Process 1900 called NtSetContextThread to modify thread in remote process 2064
Time & API Arguments Status Return Repeated

NtSetContextThread

 registers.eip: 2005598660
registers.esp: 1638384
registers.edi: 0
registers.eax: 4199136
registers.ebp: 0
registers.edx: 0
registers.ebx: 2130567168
registers.esi: 0
registers.ecx: 0
thread_handle: 0x00000238
process_identifier: 2064
1 0 0
Bkav W32.AIDetectMalware
Lionic Trojan.Win32.Agent.tshg
Elastic malicious (high confidence)
MicroWorld-eScan Gen:Variant.Nemesis.22779
FireEye Generic.mg.297c423d2a4a52a7
Malwarebytes Trojan.Injector
VIPRE Gen:Variant.Nemesis.22779
Sangfor Suspicious.Win32.Save.ins
K7GW Trojan ( 005a76941 )
CrowdStrike win/malicious_confidence_100% (D)
Arcabit Trojan.Nemesis.D58FB [many]
Cyren W32/Injector.BOF.gen!Eldorado
Symantec ML.Attribute.HighConfidence
ESET-NOD32 a variant of Win32/Injector.ETBD
APEX Malicious
Cynet Malicious (score: 100)
Kaspersky VHO:Trojan.Win32.Sdum.gen
BitDefender Gen:Variant.Nemesis.22779
Avast Win32:PWSX-gen [Trj]
Emsisoft Gen:Variant.Nemesis.22779 (B)
F-Secure Trojan.TR/AD.Swotter.jwcrh
DrWeb Trojan.Loader.1554
McAfee-GW-Edition BehavesLike.Win32.Generic.dc
Trapmine malicious.moderate.ml.score
Sophos Mal/Generic-S
Ikarus Trojan-Spy.FormBook
Avira TR/AD.Swotter.jwcrh
Microsoft Trojan:Win32/Formbook.AT!MTB
ZoneAlarm HEUR:Trojan-Spy.Win32.Noon.gen
GData Trojan.NSISX.Spy.Gen.24
Google Detected
AhnLab-V3 Trojan/Win.NSISInject.R587856
McAfee Artemis!297C423D2A4A
MAX malware (ai score=83)
Cylance unsafe
Panda Trj/Chgt.AD
Rising Trojan.Avemariarat!8.11CB9 (TFE:6:M0iIpRjbqhI)
SentinelOne Static AI - Suspicious PE
Fortinet NSIS/Agent.DCAC!tr
BitDefenderTheta Gen:NN.ZedlaF.36250.fu4@aGbp9yoi
AVG Win32:PWSX-gen [Trj]
DeepInstinct MALICIOUS