popup
Summary | ZeroBOX
  1. Home
  2. Result
  3. Report
  4. Detail Analysis

berrashok2.1.exe

NSIS UPX Malicious Library PE File DLL OS Processor Check PE32
  1. Resubmit sample
Category Machine Started Completed
FILE s1_win7_x6401 July 7, 2023, 7:29 a.m. July 7, 2023, 7:31 a.m.
Size 370.2KB
Type PE32 executable (GUI) Intel 80386, for MS Windows, Nullsoft Installer self-extracting archive
MD5 64273b56a78b2ba729ca0d023f06b51b
SHA256 677d8f0356d1a1afde7e90e35a132cc47eb2c1568648c1c90c237921df11a15a
CRC32 E0DDD137
ssdeep 6144:AYa6+F0rM1jS2lyhCCTPvpL8ZfHZx1gBN4kvqxRAHfOEZ78Y+I:AYEF0rWjP+C8p45DaN4kxTCI
Yara
  • UPX_Zero - UPX packed file
  • NSIS_Installer - Null Soft Installer
  • Malicious_Library_Zero - Malicious_Library
  • PE_Header_Zero - PE File Signature
  • IsPE32 - (no description)

Suricata Alerts

Flow SID Signature Category
TCP 192.168.56.101:49166 -> 50.117.107.194:80 2031412 ET MALWARE FormBook CnC Checkin (GET) Malware Command and Control Activity Detected
TCP 192.168.56.101:49166 -> 50.117.107.194:80 2031449 ET MALWARE FormBook CnC Checkin (GET) Malware Command and Control Activity Detected
TCP 192.168.56.101:49166 -> 50.117.107.194:80 2031453 ET MALWARE FormBook CnC Checkin (GET) Malware Command and Control Activity Detected
TCP 192.168.56.101:49165 -> 198.54.117.215:80 2031412 ET MALWARE FormBook CnC Checkin (GET) Malware Command and Control Activity Detected
TCP 192.168.56.101:49165 -> 198.54.117.215:80 2031449 ET MALWARE FormBook CnC Checkin (GET) Malware Command and Control Activity Detected
TCP 192.168.56.101:49165 -> 198.54.117.215:80 2031453 ET MALWARE FormBook CnC Checkin (GET) Malware Command and Control Activity Detected

Suricata TLS

No Suricata TLS

Time & API Arguments Status Return Repeated

GlobalMemoryStatusEx

 1 1 0
section .ndata
suspicious_features GET method with no useragent header suspicious_request GET http://www.dbszdjh.fun/sy18/?Jt7=U6JHPeuS9cFK+HdosiYdUe3kZUaaEpBIK0NQV+GndtDtxcA30TUEsLLFVDIA4mk86iP5n2oi&EHU40X=gbTpoNAPwL
suspicious_features GET method with no useragent header suspicious_request GET http://www.stockprob.com/sy18/?Jt7=1Oep3nCFFUrkcIdAUTj14MBiu14AlEMKb8QIMK+sAITCpSEZyQitY4taH9PhDo7Kfu1SD1c1&EHU40X=gbTpoNAPwL
request GET http://www.dbszdjh.fun/sy18/?Jt7=U6JHPeuS9cFK+HdosiYdUe3kZUaaEpBIK0NQV+GndtDtxcA30TUEsLLFVDIA4mk86iP5n2oi&EHU40X=gbTpoNAPwL
request GET http://www.stockprob.com/sy18/?Jt7=1Oep3nCFFUrkcIdAUTj14MBiu14AlEMKb8QIMK+sAITCpSEZyQitY4taH9PhDo7Kfu1SD1c1&EHU40X=gbTpoNAPwL
Time & API Arguments Status Return Repeated

NtProtectVirtualMemory

 process_identifier: 2556
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x732a2000
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2556
region_size: 8192
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x031c0000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2556
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x031d0000
allocation_type: 12289 (MEM_COMMIT|MEM_RESERVE)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2668
region_size: 3158016
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x00920000
allocation_type: 12288 (MEM_COMMIT|MEM_RESERVE)
process_handle: 0xffffffff
1 0 0
file C:\Users\test22\AppData\Local\Temp\nsnF147.tmp\bksfhkzcc.dll
file C:\Users\test22\AppData\Local\Temp\nsnF147.tmp\bksfhkzcc.dll
Time & API Arguments Status Return Repeated

LookupPrivilegeValueW

 system_name:
privilege_name: SeDebugPrivilege
1 1 0
Process injection Process 2556 called NtSetContextThread to modify thread in remote process 2668
Time & API Arguments Status Return Repeated

NtSetContextThread

 registers.eip: 1995571652
registers.esp: 1638384
registers.edi: 0
registers.eax: 4321552
registers.ebp: 0
registers.edx: 0
registers.ebx: 2130567168
registers.esi: 0
registers.ecx: 0
thread_handle: 0x00000240
process_identifier: 2668
1 0 0