popup
Summary | ZeroBOX
  1. Home
  2. Result
  3. Report
  4. Detail Analysis

Passw0rd_1122_To_Open_Archive.rar

KeyLogger PWS Escalate priviledges AntiDebug AntiVM
  1. Resubmit sample
Category Machine Started Completed
FILE s1_win7_x6402 July 3, 2023, 10:56 a.m. July 3, 2023, 10:58 a.m.
Size 21.3MB
Type RAR archive data, v5
MD5 2b3d3bcf435c1400b8a85945d6fe2d15
SHA256 2665c55ee0796f4954a237dc213e413dd961fd43821a40f7df5674c9a33e2e47
CRC32 C48D1312
ssdeep 393216:yEGw1XQPLZdF/QblgMwU0zgLgeswpECSISff/GOyIAaR5xVqAi:yE3yZdF/0PwU0zSgyFi/8I75xVqAi
Yara None matched

Name Response Post-Analysis Lookup
No hosts contacted.
IP Address Status Action
164.124.101.2 Active Moloch
79.137.195.246 Active Moloch
91.103.252.3 Active Moloch
94.158.245.22 Active Moloch

Suricata Alerts

Flow SID Signature Category
TCP 192.168.56.102:49175 -> 79.137.195.246:80 2016141 ET INFO Executable Download from dotted-quad Host Potentially Bad Traffic
TCP 192.168.56.102:49175 -> 79.137.195.246:80 2019714 ET MALWARE Terse alphanumeric executable downloader high likelihood of being hostile Potentially Bad Traffic
TCP 192.168.56.102:49179 -> 91.103.252.3:80 2036934 ET MALWARE Win32/RecordBreaker CnC Checkin M1 A Network Trojan was detected
TCP 91.103.252.3:80 -> 192.168.56.102:49179 2036955 ET MALWARE Win32/RecordBreaker CnC Checkin - Server Response A Network Trojan was detected
TCP 192.168.56.102:49179 -> 91.103.252.3:80 2027250 ET INFO Dotted Quad Host DLL Request Potentially Bad Traffic
TCP 192.168.56.102:49179 -> 91.103.252.3:80 2044305 ET HUNTING HTTP GET Request for nss3.dll - Possible Infostealer Activity A suspicious filename was detected
TCP 91.103.252.3:80 -> 192.168.56.102:49179 2018959 ET POLICY PE EXE or DLL Windows file download HTTP Potential Corporate Privacy Violation
TCP 192.168.56.102:49181 -> 94.158.245.22:80 2018752 ET MALWARE Generic .bin download from Dotted Quad A Network Trojan was detected
TCP 94.158.245.22:80 -> 192.168.56.102:49181 2018959 ET POLICY PE EXE or DLL Windows file download HTTP Potential Corporate Privacy Violation
TCP 94.158.245.22:80 -> 192.168.56.102:49181 2021076 ET HUNTING SUSPICIOUS Dotted Quad Host MZ Response Potentially Bad Traffic
TCP 192.168.56.102:49179 -> 91.103.252.3:80 2027250 ET INFO Dotted Quad Host DLL Request Potentially Bad Traffic
TCP 192.168.56.102:49179 -> 91.103.252.3:80 2027250 ET INFO Dotted Quad Host DLL Request Potentially Bad Traffic
TCP 192.168.56.102:49179 -> 91.103.252.3:80 2044307 ET HUNTING HTTP GET Request for vcruntime140.dll - Possible Infostealer Activity A suspicious filename was detected
TCP 192.168.56.102:49179 -> 91.103.252.3:80 2027250 ET INFO Dotted Quad Host DLL Request Potentially Bad Traffic
TCP 192.168.56.102:49179 -> 91.103.252.3:80 2044302 ET HUNTING HTTP GET Request for mozglue.dll - Possible Infostealer Activity A suspicious filename was detected
TCP 192.168.56.102:49179 -> 91.103.252.3:80 2027250 ET INFO Dotted Quad Host DLL Request Potentially Bad Traffic
TCP 192.168.56.102:49179 -> 91.103.252.3:80 2044303 ET HUNTING HTTP GET Request for freebl3.dll - Possible Infostealer Activity A suspicious filename was detected
TCP 192.168.56.102:49179 -> 91.103.252.3:80 2027250 ET INFO Dotted Quad Host DLL Request Potentially Bad Traffic
TCP 192.168.56.102:49179 -> 91.103.252.3:80 2044306 ET HUNTING HTTP GET Request for softokn3.dll - Possible Infostealer Activity A suspicious filename was detected
TCP 192.168.56.102:49179 -> 91.103.252.3:80 2027250 ET INFO Dotted Quad Host DLL Request Potentially Bad Traffic
TCP 192.168.56.102:49179 -> 91.103.252.3:80 2044301 ET HUNTING HTTP GET Request for sqlite3.dll - Possible Infostealer Activity A suspicious filename was detected
TCP 192.168.56.102:49179 -> 91.103.252.3:80 2036884 ET HUNTING Possible Generic Stealer Sending System Information Misc activity

Suricata TLS

No Suricata TLS

Time & API Arguments Status Return Repeated

IsDebuggerPresent

 0 0
Time & API Arguments Status Return Repeated

GlobalMemoryStatusEx

 1 1 0
suspicious_features GET method with no useragent header, Connection to IP address suspicious_request GET http://79.137.195.246/client7/enc.exe
suspicious_features POST method with no referer header, Connection to IP address suspicious_request POST http://91.103.252.3/
suspicious_features Connection to IP address suspicious_request GET http://91.103.252.3/aN7jD0qO6kT5bK5bQ4eR8fE1xP7hL2vK/nss3.dll
suspicious_features Connection to IP address suspicious_request GET http://91.103.252.3/aN7jD0qO6kT5bK5bQ4eR8fE1xP7hL2vK/msvcp140.dll
suspicious_features Connection to IP address suspicious_request GET http://91.103.252.3/aN7jD0qO6kT5bK5bQ4eR8fE1xP7hL2vK/vcruntime140.dll
suspicious_features Connection to IP address suspicious_request GET http://91.103.252.3/aN7jD0qO6kT5bK5bQ4eR8fE1xP7hL2vK/mozglue.dll
suspicious_features Connection to IP address suspicious_request GET http://91.103.252.3/aN7jD0qO6kT5bK5bQ4eR8fE1xP7hL2vK/freebl3.dll
suspicious_features Connection to IP address suspicious_request GET http://91.103.252.3/aN7jD0qO6kT5bK5bQ4eR8fE1xP7hL2vK/softokn3.dll
suspicious_features Connection to IP address suspicious_request GET http://91.103.252.3/aN7jD0qO6kT5bK5bQ4eR8fE1xP7hL2vK/sqlite3.dll
suspicious_features POST method with no referer header, Connection to IP address suspicious_request POST http://91.103.252.3/29337380ca3f6eacdd49120039f37335
suspicious_features Connection to IP address suspicious_request GET http://94.158.245.22/SK2E6ZYBFLD885TK/14013878658799951837.bin
request GET http://79.137.195.246/client7/enc.exe
request POST http://91.103.252.3/
request GET http://91.103.252.3/aN7jD0qO6kT5bK5bQ4eR8fE1xP7hL2vK/nss3.dll
request GET http://91.103.252.3/aN7jD0qO6kT5bK5bQ4eR8fE1xP7hL2vK/msvcp140.dll
request GET http://91.103.252.3/aN7jD0qO6kT5bK5bQ4eR8fE1xP7hL2vK/vcruntime140.dll
request GET http://91.103.252.3/aN7jD0qO6kT5bK5bQ4eR8fE1xP7hL2vK/mozglue.dll
request GET http://91.103.252.3/aN7jD0qO6kT5bK5bQ4eR8fE1xP7hL2vK/freebl3.dll
request GET http://91.103.252.3/aN7jD0qO6kT5bK5bQ4eR8fE1xP7hL2vK/softokn3.dll
request GET http://91.103.252.3/aN7jD0qO6kT5bK5bQ4eR8fE1xP7hL2vK/sqlite3.dll
request POST http://91.103.252.3/29337380ca3f6eacdd49120039f37335
request GET http://94.158.245.22/SK2E6ZYBFLD885TK/14013878658799951837.bin
request POST http://91.103.252.3/
request POST http://91.103.252.3/29337380ca3f6eacdd49120039f37335
Time & API Arguments Status Return Repeated

NtProtectVirtualMemory

 process_identifier: 2200
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x74002000
process_handle: 0xffffffff
1 0 0

NtProtectVirtualMemory

 process_identifier: 2200
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x737e3000
process_handle: 0xffffffff
1 0 0
file C:\Users\test22\AppData\Local\Temp\7zE898CF1BA\Main_Installer.exe
Time & API Arguments Status Return Repeated

LookupPrivilegeValueW

 system_name:
privilege_name: SeRestorePrivilege
1 1 0

LookupPrivilegeValueW

 system_name:
privilege_name: SeSecurityPrivilege
1 1 0
description Escalate priviledges rule Escalate_priviledges
description PWS Memory rule Generic_PWS_Memory_Zero
description (no description) rule DebuggerCheck__GlobalFlags
description (no description) rule DebuggerCheck__QueryInfo
description (no description) rule DebuggerHiding__Thread
description (no description) rule DebuggerHiding__Active
description (no description) rule ThreadControl__Context
description (no description) rule SEH__vectored
description Checks if being debugged rule anti_dbg
description Bypass DEP rule disable_dep
description Run a KeyLogger rule KeyLogger
host 79.137.195.246
host 91.103.252.3
host 94.158.245.22