Summary | ZeroBOX

Category	Machine	Started	Completed
FILE	s1_win7_x6401	July 5, 2023, 5:17 p.m.	July 5, 2023, 5:31 p.m.

Size	95.0KB
Type	PE32 executable (GUI) Intel 80386, for MS Windows
MD5	`7104f635a41839bac7835703f06f744e`
SHA256	`88502f27ab03c34af7ceda2bb6fecda42ae227e74e8a5e52346db749e200d134`
CRC32	`B92299EF`
ssdeep	`1536:auj56ycNa0SNndwAhRvTlrYZUkGnP3+RBJWPnhdTW8tBniRgR:auj5+NJINhRvTHlnP3+RB4pYwBi`
Yara	Malicious_Library_Zero - Malicious_Library PE_Header_Zero - PE File Signature IsPE32 - (no description)

setop.exe "C:\Users\test22\AppData\Local\Temp\setop.exe"
2576
- cmd.exe C:\Windows\system32\cmd.exe /c (timeout /t 60) & (reg.exe add HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run /f /reg:64 /v olUPnogcERyFGyiskq /d "C:\ProgramData\TrRJLfmPbPyzKCdX.exe")
  2640
  - timeout.exe timeout /t 60
    2760
  - reg.exe reg.exe add HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run /f /reg:64 /v olUPnogcERyFGyiskq /d "C:\ProgramData\TrRJLfmPbPyzKCdX.exe"
    2660
- cmd.exe cmd.exe /c (timeout /t 10) & (del /F /Q "C:\Users\test22\AppData\Local\Temp\setop.exe") & (start "" "C:\ProgramData\TrRJLfmPbPyzKCdX.exe")
  2684
  - timeout.exe timeout /t 10
    2768
  - TrRJLfmPbPyzKCdX.exe "C:\ProgramData\TrRJLfmPbPyzKCdX.exe"
    2936
    - cmd.exe C:\Windows\system32\cmd.exe /c (timeout /t 60) & (reg.exe add HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run /f /reg:64 /v olUPnogcERyFGyiskq /d "C:\ProgramData\TrRJLfmPbPyzKCdX.exe")
      3008
      - timeout.exe timeout /t 60
        744
      - reg.exe reg.exe add HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run /f /reg:64 /v olUPnogcERyFGyiskq /d "C:\ProgramData\TrRJLfmPbPyzKCdX.exe"
        2800

Name	Response	Post-Analysis Lookup
No hosts contacted.

IP Address	Status	Action
91.235.136.155	Active	Moloch

Suricata Alerts

Flow	SID	Signature	Category
TCP 192.168.56.101:49169 -> 91.235.136.155:443	2045211	ET MALWARE Suspected Win32/HMR RAT/LOBSHOT Initial Handshake	A Network Trojan was detected

Suricata TLS

No Suricata TLS

Queries for the computername (4 events)

Time & API	Arguments	Status	Return
GetComputerNameA July 5, 2023, 5:17 p.m.	computer_name: TEST22-PC	1	1
GetComputerNameW July 5, 2023, 5:17 p.m.	computer_name: TEST22-PC	1	1
GetComputerNameA July 5, 2023, 5:17 p.m.	computer_name: TEST22-PC	1	1
GetComputerNameW July 5, 2023, 5:17 p.m.	computer_name: TEST22-PC	1	1

Command line console output was observed (8 events)

Time & API	Arguments	Status	Return
WriteConsoleW July 5, 2023, 5:17 p.m.	buffer: Waiting for 60 console_handle: 0x00000007	1	1
WriteConsoleW July 5, 2023, 5:17 p.m.	buffer: seconds, press a key to continue ... console_handle: 0x00000007	1	1
WriteConsoleW July 5, 2023, 5:17 p.m.	buffer: Waiting for 10 console_handle: 0x00000007	1	1
WriteConsoleW July 5, 2023, 5:17 p.m.	buffer: seconds, press a key to continue ... console_handle: 0x00000007	1	1
WriteConsoleW July 5, 2023, 5:17 p.m.	buffer: Waiting for 60 console_handle: 0x00000007	1	1
WriteConsoleW July 5, 2023, 5:17 p.m.	buffer: seconds, press a key to continue ... console_handle: 0x00000007	1	1
WriteConsoleW July 5, 2023, 5:18 p.m.	buffer: The operation completed successfully. console_handle: 0x00000007	1	1
WriteConsoleW July 5, 2023, 5:18 p.m.	buffer: The operation completed successfully. console_handle: 0x00000007	1	1

Collects information to fingerprint the system (MachineGuid, DigitalProductId, SystemBiosDate) (1 event)

registry

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\MachineGuid

Steals private information from local Internet browsers (42 events)

file	C:\Users\test22\AppData\Local\Google\Chrome\User Data\Profile 3\Extensions\
file	C:\Users\test22\AppData\Local\Google\Chrome\User Data\Default\Extensions\jbdaocneiiinmjbjlgalhcelgbejmnid
file	C:\Users\test22\AppData\Local\Google\Chrome\User Data\Default\Extensions\hpglfhgfnhbgpjdenjgmdgoeiappafln
file	C:\Users\test22\AppData\Local\Google\Chrome\User Data\Default\Extensions\kpfopkelmapcoipemfendmdcghnegimn
file	C:\Users\test22\AppData\Local\Google\Chrome\User Data\Default\Extensions\aodkkagnadcbobfpggfnjeongemjbjca
file	C:\Users\test22\AppData\Local\Google\Chrome\User Data\Profile 6\Extensions\
file	C:\Users\test22\AppData\Local\Google\Chrome\User Data\Default\Extensions\lpfcbjknijpeeillifnkikgncikgfhdo
file	C:\Users\test22\AppData\Local\Google\Chrome\User Data\Profile 1\Extensions\
file	C:\Users\test22\AppData\Local\Google\Chrome\User Data\Default\Extensions\aiifbnbfobpmeekipheeijimdpnlpgpp
file	C:\Users\test22\AppData\Local\Google\Chrome\User Data\Default\Extensions\hmeobnfnfcmdkdcmlblgagmfpfboieaf
file	C:\Users\test22\AppData\Local\Google\Chrome\User Data\Profile 4\Extensions\
file	C:\Users\test22\AppData\Local\Google\Chrome\User Data\Default\Extensions\fhbohimaelbohpjbbldcngcnapndodjp
file	C:\Users\test22\AppData\Local\Google\Chrome\User Data\Default\Extensions\nlbmnnijcnlegkjjpcfjclmcfggfefdm
file	C:\Users\test22\AppData\Local\Google\Chrome\User Data\Profile 8\Extensions\
file	C:\Users\test22\AppData\Local\Google\Chrome\User Data\Profile 7\Extensions\
file	C:\Users\test22\AppData\Local\Google\Chrome\User Data\Default\Extensions\nkbihfbeogaeaoehlefnkodbefgpgknn
file	C:\Users\test22\AppData\Local\Google\Chrome\User Data\Default\Extensions\fihkakfobkmkjojpchpfgcmhfjnmnfpi
file	C:\Users\test22\AppData\Local\Google\Chrome\User Data\Default\Extensions\blnieiiffboillknjnepogjhkgnoapac
file	C:\Users\test22\AppData\Local\Google\Chrome\User Data\Default\Extensions\bfnaelmomeimhlpmgjnjophhpkkoljpa
file	C:\Users\test22\AppData\Local\Google\Chrome\User Data\Default\Extensions\bhghoamapcdpbohphigoooaddinpkbai
file	C:\Users\test22\AppData\Local\Google\Chrome\User Data\Profile 5\Extensions\
file	C:\Users\test22\AppData\Local\Google\Chrome\User Data\Default\Extensions\nanjmdknhkinifnkgdcggcfnhdaammmj
file	C:\Users\test22\AppData\Local\Google\Chrome\User Data\Default\Extensions\dngmlblcodfobpdpecaadgfbcggfjfnm
file	C:\Users\test22\AppData\Local\Google\Chrome\User Data\Default\Extensions\cgeeodpfagjceefieflmdfphplkenlfk
file	C:\Users\test22\AppData\Local\Google\Chrome\User Data\Default\Extensions\pdadjkfkgcafgbceimcpbkalnfnepbnk
file	C:\Users\test22\AppData\Local\Google\Chrome\User Data\Default\Extensions\odbfpeeihdkbihmopkbjmoonfanlbfcl
file	C:\Users\test22\AppData\Local\Google\Chrome\User Data\Default\Extensions\hnfanknocfeofbddgcijnmhnfnkdnaad
file	C:\Users\test22\AppData\Local\Google\Chrome\User Data\Default\Extensions\ibnejdfjmmkpcnlpebklmnkoeoihofec
file	C:\Users\test22\AppData\Local\Google\Chrome\User Data\Default\Extensions\kncchdigobghenbbaddojjnnaogfppfj
file	C:\Users\test22\AppData\Local\Google\Chrome\User Data\Default\Extensions\aeachknmefphepccionboohckonoeemg
file	C:\Users\test22\AppData\Local\Google\Chrome\User Data\Default\Extensions\mgffkfbidihjpoaomajlbgchddlicgpn
file	C:\Users\test22\AppData\Local\Google\Chrome\User Data\Default\Extensions\fnjhmkhhmkbjkkabndcnnogagogbneec
file	C:\Users\test22\AppData\Local\Google\Chrome\User Data\Profile 2\Extensions\
file	C:\Users\test22\AppData\Local\Google\Chrome\User Data\Default\Extensions\fhilaheimglignddkjgofkcbgekhenbh
file	C:\Users\test22\AppData\Local\Google\Chrome\User Data\Default\Extensions\fnnegphlobjdpkhecapkijjdkgcjhkib
file	C:\Users\test22\AppData\Local\Google\Chrome\User Data\Profile 9\Extensions\
file	C:\Users\test22\AppData\Local\Google\Chrome\User Data\Default\Extensions\afbcbjpbpfadlkmhmclhkeeodmamcflc
file	C:\Users\test22\AppData\Local\Google\Chrome\User Data\Default\Extensions\amkmjjmmflddogmhpjloimipbofnfjih
file	C:\Users\test22\AppData\Local\Google\Chrome\User Data\Default\Extensions\cjelfplplebdjjenllpjcblmjkfcffne
file	C:\Users\test22\AppData\Local\Google\Chrome\User Data\Profile 0\Extensions\
file	C:\Users\test22\AppData\Local\Google\Chrome\User Data\Default\Extensions\ffnbelfdoeiohenkjibnmadjiehjhajb
file	C:\Users\test22\AppData\Local\Google\Chrome\User Data\Default\Extensions\nkddgncdjgjfcddamfgcmfnlhccnimig

Creates a suspicious process (2 events)

cmdline	C:\Windows\system32\cmd.exe /c (timeout /t 60) & (reg.exe add HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run /f /reg:64 /v olUPnogcERyFGyiskq /d "C:\ProgramData\TrRJLfmPbPyzKCdX.exe")
cmdline	cmd.exe /c (timeout /t 10) & (del /F /Q "C:\Users\test22\AppData\Local\Temp\setop.exe") & (start "" "C:\ProgramData\TrRJLfmPbPyzKCdX.exe")

Drops an executable to the user AppData folder (1 event)

file	C:\Users\test22\AppData\Local\Temp\setop.exe

Searches running processes potentially to identify processes for sandbox evasion, code injection or memory dumping (10 events)

Time & API	Arguments	Status	Return
Process32NextW July 5, 2023, 5:17 p.m.	snapshot_handle: 0x000000b4 process_name: mobsync.exe process_identifier: 2276	1	1
Process32NextW July 5, 2023, 5:17 p.m.	snapshot_handle: 0x000000b4 process_name: pw.exe process_identifier: 2320	1	1
Process32NextW July 5, 2023, 5:17 p.m.	snapshot_handle: 0x000000b4 process_name: wsqmcons.exe process_identifier: 2356	1	1
Process32NextW July 5, 2023, 5:17 p.m.	snapshot_handle: 0x000000b4 process_name: sdclt.exe process_identifier: 2384	1	1
Process32NextW July 5, 2023, 5:17 p.m.	snapshot_handle: 0x000000b4 process_name: taskhost.exe process_identifier: 2440	1	1
Process32NextW July 5, 2023, 5:17 p.m.	snapshot_handle: 0x000000b4 process_name: setop.exe process_identifier: 2576	1	1
Process32NextW July 5, 2023, 5:17 p.m.	snapshot_handle: 0x000000b4 process_name: conhost.exe process_identifier: 2676	1	1
Process32NextW July 5, 2023, 5:17 p.m.	snapshot_handle: 0x000000b4 process_name: conhost.exe process_identifier: 2728	1	1
Process32NextW July 5, 2023, 5:17 p.m.	snapshot_handle: 0x000000b4 process_name: timeout.exe process_identifier: 2760	1	1
Process32NextW July 5, 2023, 5:17 p.m.	snapshot_handle: 0x000000b4 process_name: TrRJLfmPbPyzKCdX.exe process_identifier: 2936	1	1

Moves the original executable to a new location (1 event)

Time & API	Arguments	Status	Return	Repeated
MoveFileWithProgressW July 5, 2023, 5:17 p.m.	newfilepath_r: flags: 4 oldfilepath_r: C:\Users\test22\AppData\Local\Temp\setop.exe newfilepath: oldfilepath: C:\Users\test22\AppData\Local\Temp\setop.exe	1	1	0

Expresses interest in specific running processes (3 events)

process	trrjlfmpbpyzkcdx.exe
process	setop.exe
process	cmd.exe

Yara rule detected in process memory (32 events)

description	Create a windows service	rule	Create_Service
description	Communications over RAW Socket	rule	Network_TCP_Socket
description	File Downloader	rule	Network_Downloader
description	Communication using DGA	rule	Network_DGA
description	Steal credential	rule	local_credential_Steal
description	Escalate priviledges	rule	Escalate_priviledges
description	Code injection with CreateRemoteThread in a remote process	rule	Code_injection
description	Communications over HTTP	rule	Network_HTTP
description	PWS Memory	rule	Generic_PWS_Memory_Zero
description	Record Audio	rule	Sniff_Audio
description	Communications use DNS	rule	Network_DNS
description	Take ScreenShot	rule	ScreenShot
description	Match Windows Http API call	rule	Str_Win32_Http_API
description	Match Windows Inet API call	rule	Str_Win32_Internet_API
description	(no description)	rule	DebuggerCheck__GlobalFlags
description	(no description)	rule	DebuggerCheck__QueryInfo
description	(no description)	rule	DebuggerCheck__RemoteAPI
description	(no description)	rule	DebuggerHiding__Thread
description	(no description)	rule	DebuggerHiding__Active
description	(no description)	rule	DebuggerException__ConsoleCtrl
description	(no description)	rule	DebuggerException__SetConsoleCtrl
description	(no description)	rule	ThreadControl__Context
description	(no description)	rule	SEH__vectored
description	(no description)	rule	Check_Dlls
description	Checks if being debugged	rule	anti_dbg
description	Anti-Sandbox checks for ThreatExpert	rule	antisb_threatExpert
description	Bypass DEP	rule	disable_dep
description	Affect hook table	rule	win_hook
description	Install itself for autorun at Windows startup	rule	Persistence
description	Communications over FTP	rule	Network_FTP
description	Run a KeyLogger	rule	KeyLogger
description	Communications over P2P network	rule	Network_P2P_Win

Uses Windows utilities for basic Windows functionality (3 events)

cmdline	reg.exe add HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run /f /reg:64 /v olUPnogcERyFGyiskq /d "C:\ProgramData\TrRJLfmPbPyzKCdX.exe"
cmdline	C:\Windows\system32\cmd.exe /c (timeout /t 60) & (reg.exe add HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run /f /reg:64 /v olUPnogcERyFGyiskq /d "C:\ProgramData\TrRJLfmPbPyzKCdX.exe")
cmdline	cmd.exe /c (timeout /t 10) & (del /F /Q "C:\Users\test22\AppData\Local\Temp\setop.exe") & (start "" "C:\ProgramData\TrRJLfmPbPyzKCdX.exe")

Communicates with host for which no DNS query was performed (1 event)

host

91.235.136.155

Installs itself for autorun at Windows startup (2 events)

reg_key	HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\olUPnogcERyFGyiskq				reg_value	C:\ProgramData\TrRJLfmPbPyzKCdX.exe
reg_key	HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\olUPnogcERyFGyiskq				reg_value	C:\ProgramData\TrRJLfmPbPyzKCdX.exe

Deletes executed files from disk (1 event)

file	C:\ProgramData\TrRJLfmPbPyzKCdX.exe

Resumed a suspended thread in a remote process potentially indicative of process injection (2 events)

Time & API	Arguments	Status	Return	Repeated
Process injection	Process 2684 resumed a thread in remote process 2936
NtResumeThread July 5, 2023, 5:17 p.m.	thread_handle: 0x00000088 suspend_count: 0 process_identifier: 2936	1	0	0

File has been identified by 33 AntiVirus engines on VirusTotal as malicious (33 events)

Bkav	W32.AIDetectMalware
MicroWorld-eScan	Gen:Variant.Lazy.271868
McAfee	GenericRXVX-DB!7104F635A418
VIPRE	Gen:Variant.Lazy.271868
Sangfor	Trojan.Win32.Agent.As5t
Arcabit	Trojan.Lazy.D425FC
Symantec	ML.Attribute.HighConfidence
Elastic	Windows.Trojan.Lobshot
ESET-NOD32	a variant of Win32/Agent.ADYK
Cynet	Malicious (score: 99)
APEX	Malicious
Kaspersky	HEUR:Backdoor.Win32.DarkVNC.gen
BitDefender	Gen:Variant.Lazy.271868
Avast	Win32:MalwareX-gen [Trj]
Emsisoft	Gen:Variant.Lazy.271868 (B)
F-Secure	Trojan.TR/Crypt.XPACK.Gen3
DrWeb	BackDoor.Siggen2.4466
McAfee-GW-Edition	BehavesLike.Win32.Dropper.nh
Trapmine	suspicious.low.ml.score
FireEye	Gen:Variant.Lazy.271868
Avira	TR/Crypt.XPACK.Gen3
Microsoft	Program:Win32/Wacapew.C!ml
ZoneAlarm	HEUR:Backdoor.Win32.DarkVNC.gen
GData	Gen:Variant.Lazy.271868
AhnLab-V3	Trojan/Win.Generic.C5396646
ALYac	Gen:Variant.Lazy.271868
MAX	malware (ai score=85)
Cylance	unsafe
Rising	Trojan.Agent!8.B1E (TFE:3:lVmKEGZ4QoP)
BitDefenderTheta	Gen:NN.ZexaF.36270.fu0@ai5jF9mi
AVG	Win32:MalwareX-gen [Trj]
DeepInstinct	MALICIOUS
CrowdStrike	win/malicious_confidence_70% (W)

setop.exe

Process Tree Toggle all

Network Toggle all

Suricata Toggle all

Suricata Alerts

Suricata TLS

Signatures Toggle All