popup
Summary | ZeroBOX
  1. Home
  2. Result
  3. Report
  4. Detail Analysis

RegEdit.exe

NSIS UPX Malicious Library PE File DLL OS Processor Check PE32
  1. Resubmit sample
Category Machine Started Completed
FILE s1_win7_x6401 July 4, 2023, 5:30 p.m. July 4, 2023, 5:33 p.m.
Size 352.7KB
Type PE32 executable (GUI) Intel 80386, for MS Windows, Nullsoft Installer self-extracting archive
MD5 923b2cf57335ee5730c03f793b9b465a
SHA256 53bb0f293733cadbf6b5704cd0359b61acaa6367eb49268905714492d35ddf81
CRC32 1678514B
ssdeep 6144:vYa6VB0R719FRWlAQR/P9Zpim8lMvGMsAzKDv4Wkm2wG+8p9rNvQr/zh/QCM9OF7:vYnyR71H4RsmaMvX+DAWkZMCVKzhC9It
Yara
  • UPX_Zero - UPX packed file
  • Malicious_Library_Zero - Malicious_Library
  • PE_Header_Zero - PE File Signature
  • NSIS_Installer - Null Soft Installer
  • IsPE32 - (no description)

Name Response Post-Analysis Lookup
www.skywardcaresolutions.com
CNAME skywardcaresolutions.com
A 34.102.136.180
34.102.136.180
www.wpdisk.online
A 162.246.16.124
162.246.16.124
www.knackwoodcraft.com
A 103.224.182.242
103.224.182.242
www.georgiapoolrepair.com
A 3.64.163.50
3.64.163.50
IP Address Status Action
103.224.182.242 Active Moloch
162.246.16.124 Active Moloch
164.124.101.2 Active Moloch
3.64.163.50 Active Moloch
34.102.136.180 Active Moloch

Suricata Alerts

Flow SID Signature Category
TCP 192.168.56.101:49167 -> 34.102.136.180:80 2031412 ET MALWARE FormBook CnC Checkin (GET) Malware Command and Control Activity Detected
TCP 192.168.56.101:49167 -> 34.102.136.180:80 2031449 ET MALWARE FormBook CnC Checkin (GET) Malware Command and Control Activity Detected
TCP 192.168.56.101:49167 -> 34.102.136.180:80 2031453 ET MALWARE FormBook CnC Checkin (GET) Malware Command and Control Activity Detected
TCP 192.168.56.101:49166 -> 162.246.16.124:80 2031412 ET MALWARE FormBook CnC Checkin (GET) Malware Command and Control Activity Detected
TCP 192.168.56.101:49166 -> 162.246.16.124:80 2031449 ET MALWARE FormBook CnC Checkin (GET) Malware Command and Control Activity Detected
TCP 192.168.56.101:49166 -> 162.246.16.124:80 2031453 ET MALWARE FormBook CnC Checkin (GET) Malware Command and Control Activity Detected
TCP 192.168.56.101:49168 -> 103.224.182.242:80 2031412 ET MALWARE FormBook CnC Checkin (GET) Malware Command and Control Activity Detected
TCP 192.168.56.101:49168 -> 103.224.182.242:80 2031449 ET MALWARE FormBook CnC Checkin (GET) Malware Command and Control Activity Detected
TCP 192.168.56.101:49168 -> 103.224.182.242:80 2031453 ET MALWARE FormBook CnC Checkin (GET) Malware Command and Control Activity Detected
TCP 192.168.56.101:49165 -> 3.64.163.50:80 2031412 ET MALWARE FormBook CnC Checkin (GET) Malware Command and Control Activity Detected
TCP 192.168.56.101:49165 -> 3.64.163.50:80 2031449 ET MALWARE FormBook CnC Checkin (GET) Malware Command and Control Activity Detected
TCP 192.168.56.101:49165 -> 3.64.163.50:80 2031453 ET MALWARE FormBook CnC Checkin (GET) Malware Command and Control Activity Detected

Suricata TLS

No Suricata TLS

Time & API Arguments Status Return Repeated

GlobalMemoryStatusEx

 1 1 0
section .ndata
suspicious_features GET method with no useragent header suspicious_request GET http://www.georgiapoolrepair.com/m42i/?Tj8=sca8Wgav+7lpr46mO2SOfn8L1FqfIRKRflu72oULm95UjSDEvk18j06OoJk9i9lBkDmqwETQ&6l=t8eH-ni8gH7P7
suspicious_features GET method with no useragent header suspicious_request GET http://www.wpdisk.online/m42i/?Tj8=0sZ28+ci8yt/ivZsj55lF15XBhnwAOFinpe3O8Cu7exdqn0Kmyu5eUmJDSvcLDOVyCRsFL+q&6l=t8eH-ni8gH7P7
suspicious_features GET method with no useragent header suspicious_request GET http://www.skywardcaresolutions.com/m42i/?Tj8=HYStpBgXm5OSuuoTrjSOUG+Ep+BfwFVeF26GwyixNj4tMYPsRs5ox28XQOKN0Z9jWLsOl7rl&6l=t8eH-ni8gH7P7
suspicious_features GET method with no useragent header suspicious_request GET http://www.knackwoodcraft.com/m42i/?Tj8=xCeaUZyvi6lN/KmTLqcakS33huDpVYz01lvWq0zTkBCYj/gauxIj8jp1kNsv+HiFGZvFrtg2&6l=t8eH-ni8gH7P7
request GET http://www.georgiapoolrepair.com/m42i/?Tj8=sca8Wgav+7lpr46mO2SOfn8L1FqfIRKRflu72oULm95UjSDEvk18j06OoJk9i9lBkDmqwETQ&6l=t8eH-ni8gH7P7
request GET http://www.wpdisk.online/m42i/?Tj8=0sZ28+ci8yt/ivZsj55lF15XBhnwAOFinpe3O8Cu7exdqn0Kmyu5eUmJDSvcLDOVyCRsFL+q&6l=t8eH-ni8gH7P7
request GET http://www.skywardcaresolutions.com/m42i/?Tj8=HYStpBgXm5OSuuoTrjSOUG+Ep+BfwFVeF26GwyixNj4tMYPsRs5ox28XQOKN0Z9jWLsOl7rl&6l=t8eH-ni8gH7P7
request GET http://www.knackwoodcraft.com/m42i/?Tj8=xCeaUZyvi6lN/KmTLqcakS33huDpVYz01lvWq0zTkBCYj/gauxIj8jp1kNsv+HiFGZvFrtg2&6l=t8eH-ni8gH7P7
Time & API Arguments Status Return Repeated

NtProtectVirtualMemory

 process_identifier: 2548
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x732a2000
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2548
region_size: 8192
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x032e0000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2548
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x03300000
allocation_type: 12289 (MEM_COMMIT|MEM_RESERVE)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2660
region_size: 3158016
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x00920000
allocation_type: 12288 (MEM_COMMIT|MEM_RESERVE)
process_handle: 0xffffffff
1 0 0
file C:\Users\test22\AppData\Roaming\iiqaavf\fbkktp.exe
file C:\Users\test22\AppData\Local\Temp\nslF0AB.tmp\heqtnvfb.dll
file C:\Users\test22\AppData\Local\Temp\nslF0AB.tmp\heqtnvfb.dll
file C:\Users\test22\AppData\Roaming\iiqaavf\fbkktp.exe
Time & API Arguments Status Return Repeated

LookupPrivilegeValueW

 system_name:
privilege_name: SeDebugPrivilege
1 1 0
reg_key HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run\yyienjsscxxhqq reg_value C:\Users\test22\AppData\Roaming\iiqaavf\fbkktp.exe "C:\Users\test22\AppData\Local\Temp\RegEdit.exe"
Process injection Process 2548 called NtSetContextThread to modify thread in remote process 2660
Time & API Arguments Status Return Repeated

NtSetContextThread

 registers.eip: 1995571652
registers.esp: 1638384
registers.edi: 0
registers.eax: 4321408
registers.ebp: 0
registers.edx: 0
registers.ebx: 2130567168
registers.esi: 0
registers.ecx: 0
thread_handle: 0x00000220
process_identifier: 2660
1 0 0
Bkav W32.AIDetectMalware
Lionic Trojan.Win32.Agent.tshg
Elastic malicious (high confidence)
MicroWorld-eScan Gen:Variant.Nemesis.23876
ALYac Trojan.NSISX.Spy.Gen.24
Malwarebytes Generic.Malware/Suspicious
Sangfor Suspicious.Win32.Save.ins
Cybereason malicious.9f5527
Arcabit Trojan.Nemesis.D5D44 [many]
Cyren W32/Injector.BOI.gen!Eldorado
Symantec ML.Attribute.HighConfidence
ESET-NOD32 a variant of Win32/Injector.ETCC
APEX Malicious
Kaspersky UDS:DangerousObject.Multi.Generic
BitDefender Gen:Variant.Nemesis.23876
Avast Win32:TrojanX-gen [Trj]
Emsisoft Gen:Variant.Nemesis.23876 (B)
VIPRE Gen:Variant.Nemesis.23876
McAfee-GW-Edition BehavesLike.Win32.Generic.fc
Trapmine malicious.moderate.ml.score
FireEye Generic.mg.923b2cf57335ee57
Sophos Mal/Generic-S
SentinelOne Static AI - Suspicious PE
Google Detected
MAX malware (ai score=81)
Microsoft Trojan:Win32/Sabsik.FL.B!ml
ZoneAlarm UDS:DangerousObject.Multi.Generic
GData Win32.Trojan.Agent.QBIPL1
Cynet Malicious (score: 100)
AhnLab-V3 Trojan/Win.Generic.R587806
Acronis suspicious
McAfee Artemis!923B2CF57335
Cylance unsafe
TrendMicro-HouseCall TROJ_GEN.R002H01G423
Rising Trojan.Injector!8.C4 (TFE:6:mGe17sBdx5E)
Ikarus Trojan-Spy.FormBook
Fortinet NSIS/Agent.DCAC!tr
AVG Win32:TrojanX-gen [Trj]
DeepInstinct MALICIOUS
CrowdStrike win/malicious_confidence_100% (W)