Summary | ZeroBOX

Category	Machine	Started	Completed
FILE	s1_win7_x6403_us	July 7, 2023, 7:29 a.m.	July 7, 2023, 7:34 a.m.

Size	284.2KB
Type	PE32 executable (GUI) Intel 80386, for MS Windows, Nullsoft Installer self-extracting archive
MD5	`247054964499405f52185f24b4d011b2`
SHA256	`ae8635ca2e1ddd94610dfeb8d18ce3e037e890927cb1ba3944bfe4ff70f4ce17`
CRC32	`58AB2353`
ssdeep	`6144:AYa6/09Vj/dY0A4fPsfGafr4SM7rshlsdu3F0a6Y98E:AYxKxW0q+dnM2w2s`
Yara	UPX_Zero - UPX packed file NSIS_Installer - Null Soft Installer Malicious_Library_Zero - Malicious_Library PE_Header_Zero - PE File Signature IsPE32 - (no description)

maigoneo2.1.exe "C:\Users\test22\AppData\Local\Temp\maigoneo2.1.exe"
840
- maigoneo2.1.exe "C:\Users\test22\AppData\Local\Temp\maigoneo2.1.exe"
  2068
explorer.exe C:\Windows\Explorer.EXE
1236

Name	Response	Post-Analysis Lookup
jevron.duckdns.org	A 84.54.50.66	84.54.50.66

IP Address	Status	Action
164.124.101.2	Active	Moloch
84.54.50.66	Active	Moloch

Flow	SID	Signature	Category
TCP 84.54.50.66:6060 -> 192.168.56.103:49165	2036735	ET MALWARE Ave Maria/Warzone RAT Encrypted CnC Checkin (Inbound)	Malware Command and Control Activity Detected
TCP 192.168.56.103:49165 -> 84.54.50.66:6060	2036734	ET MALWARE Ave Maria/Warzone RAT Encrypted CnC Checkin	Malware Command and Control Activity Detected
UDP 192.168.56.103:52760 -> 164.124.101.2:53	2042936	ET INFO DYNAMIC_DNS Query to a *.duckdns .org Domain	Potentially Bad Traffic
UDP 192.168.56.103:52760 -> 164.124.101.2:53	2022918	ET INFO DYNAMIC_DNS Query to *.duckdns. Domain	Misc activity

No Suricata TLS

Time & API	Arguments	Status	Return	Repeated
GetComputerNameW July 7, 2023, 7:29 a.m.	computer_name: TEST22-PC	1	1	0

registry

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\MachineGuid

Time & API	Arguments	Status	Return	Repeated
GlobalMemoryStatusEx July 7, 2023, 7:29 a.m.		1	1	0

section

.ndata

domain

jevron.duckdns.org

Time & API	Arguments	Status
NtAllocateVirtualMemory July 7, 2023, 7:29 a.m.	process_identifier: 840 region_size: 8192 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x02d50000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory July 7, 2023, 7:29 a.m.	process_identifier: 840 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x02d60000 allocation_type: 12289 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0xffffffff	1
NtAllocateVirtualMemory July 7, 2023, 7:30 a.m.	process_identifier: 1236 region_size: 65536 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0000000004d50000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1

file	C:\Users\test22\AppData\Local\Temp\nsfBF07.tmp\lfhdv.dll
file	C:\Users\test22\AppData\Roaming\enjsn\wgcluqavfoktdy.exe

file	C:\Users\test22\AppData\Roaming\enjsn\wgcluqavfoktdy.exe
file	C:\Users\test22\AppData\Local\Temp\nsfBF07.tmp\lfhdv.dll

reg_key

HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run\ienwrbk

reg_value

C:\Users\test22\AppData\Roaming\enjsn\wgcluqavfoktdy.exe "C:\Users\test22\AppData\Local\Temp\maigoneo2.1.exe"

Time & API	Arguments	Status	Return	Repeated
SetWindowsHookExA July 7, 2023, 7:29 a.m.	thread_identifier: 0 callback_function: 0x004074c0 hook_identifier: 13 (WH_KEYBOARD_LL) module_address: 0x00400000	1	131539	0

Time & API	Arguments	Status	Return	Repeated
Process injection	Process 840 called NtSetContextThread to modify thread in remote process 2068
NtSetContextThread July 7, 2023, 7:29 a.m.	registers.eip: 2005598660 registers.esp: 1638384 registers.edi: 0 registers.eax: 4216632 registers.ebp: 0 registers.edx: 0 registers.ebx: 2130567168 registers.esi: 0 registers.ecx: 0 thread_handle: 0x0000023c process_identifier: 2068	1	0	0

maigoneo2.1.exe