popup
Summary | ZeroBOX
  1. Home
  2. Result
  3. Report
  4. Detail Analysis

csrssfs.exe

NSIS UPX Malicious Library PE File DLL PE32
  1. Resubmit sample
Category Machine Started Completed
FILE s1_win7_x6401 July 18, 2023, 7:16 a.m. July 18, 2023, 7:25 a.m.
Size 254.7KB
Type PE32 executable (GUI) Intel 80386, for MS Windows, Nullsoft Installer self-extracting archive
MD5 2bdd38681778a2be9d40177c6f8a3319
SHA256 741d19e0d36879bfe434d667669315cf244fc0b31813a6f81deba7c6bb3d6fb7
CRC32 E1BE4FE7
ssdeep 6144:/Ya6QtzV5BwDpWGUFvSu9wVrpAW+3qgqiMPn2KaAbjQqFQa/oEI:/YGth8QzmVrpAW8nqn21az/o3
Yara
  • UPX_Zero - UPX packed file
  • NSIS_Installer - Null Soft Installer
  • Malicious_Library_Zero - Malicious_Library
  • PE_Header_Zero - PE File Signature
  • IsPE32 - (no description)

Suricata Alerts

Flow SID Signature Category
UDP 192.168.56.101:53850 -> 164.124.101.2:53 2027867 ET INFO Observed DNS Query to .life TLD Potentially Bad Traffic
TCP 192.168.56.101:49172 -> 18.214.48.22:80 2027876 ET INFO HTTP Request to Suspicious *.life Domain Potentially Bad Traffic
TCP 192.168.56.101:49173 -> 18.214.48.22:80 2027876 ET INFO HTTP Request to Suspicious *.life Domain Potentially Bad Traffic
TCP 192.168.56.101:49173 -> 18.214.48.22:80 2027876 ET INFO HTTP Request to Suspicious *.life Domain Potentially Bad Traffic
TCP 192.168.56.101:49173 -> 18.214.48.22:80 2027876 ET INFO HTTP Request to Suspicious *.life Domain Potentially Bad Traffic
TCP 192.168.56.101:49166 -> 103.127.237.208:80 2031412 ET MALWARE FormBook CnC Checkin (GET) Malware Command and Control Activity Detected
TCP 192.168.56.101:49166 -> 103.127.237.208:80 2031449 ET MALWARE FormBook CnC Checkin (GET) Malware Command and Control Activity Detected
TCP 192.168.56.101:49166 -> 103.127.237.208:80 2031453 ET MALWARE FormBook CnC Checkin (GET) Malware Command and Control Activity Detected
TCP 192.168.56.101:49171 -> 198.177.123.159:80 2031412 ET MALWARE FormBook CnC Checkin (GET) Malware Command and Control Activity Detected
TCP 192.168.56.101:49171 -> 198.177.123.159:80 2031449 ET MALWARE FormBook CnC Checkin (GET) Malware Command and Control Activity Detected
TCP 192.168.56.101:49171 -> 198.177.123.159:80 2031453 ET MALWARE FormBook CnC Checkin (GET) Malware Command and Control Activity Detected
TCP 192.168.56.101:49173 -> 18.214.48.22:80 2031412 ET MALWARE FormBook CnC Checkin (GET) Malware Command and Control Activity Detected
TCP 192.168.56.101:49173 -> 18.214.48.22:80 2031449 ET MALWARE FormBook CnC Checkin (GET) Malware Command and Control Activity Detected
TCP 192.168.56.101:49173 -> 18.214.48.22:80 2031453 ET MALWARE FormBook CnC Checkin (GET) Malware Command and Control Activity Detected
TCP 192.168.56.101:49173 -> 18.214.48.22:80 2027876 ET INFO HTTP Request to Suspicious *.life Domain Potentially Bad Traffic
TCP 192.168.56.101:49183 -> 152.228.216.134:80 2031412 ET MALWARE FormBook CnC Checkin (GET) Malware Command and Control Activity Detected
TCP 192.168.56.101:49183 -> 152.228.216.134:80 2031449 ET MALWARE FormBook CnC Checkin (GET) Malware Command and Control Activity Detected
TCP 192.168.56.101:49177 -> 172.96.191.121:80 2031412 ET MALWARE FormBook CnC Checkin (GET) Malware Command and Control Activity Detected
TCP 192.168.56.101:49183 -> 152.228.216.134:80 2031453 ET MALWARE FormBook CnC Checkin (GET) Malware Command and Control Activity Detected
TCP 192.168.56.101:49177 -> 172.96.191.121:80 2031449 ET MALWARE FormBook CnC Checkin (GET) Malware Command and Control Activity Detected
TCP 192.168.56.101:49177 -> 172.96.191.121:80 2031453 ET MALWARE FormBook CnC Checkin (GET) Malware Command and Control Activity Detected
TCP 192.168.56.101:49186 -> 93.125.99.130:80 2031412 ET MALWARE FormBook CnC Checkin (GET) Malware Command and Control Activity Detected
TCP 192.168.56.101:49186 -> 93.125.99.130:80 2031449 ET MALWARE FormBook CnC Checkin (GET) Malware Command and Control Activity Detected
TCP 192.168.56.101:49186 -> 93.125.99.130:80 2031453 ET MALWARE FormBook CnC Checkin (GET) Malware Command and Control Activity Detected
TCP 192.168.56.101:49181 -> 192.254.233.88:80 2031412 ET MALWARE FormBook CnC Checkin (GET) Malware Command and Control Activity Detected
TCP 192.168.56.101:49181 -> 192.254.233.88:80 2031449 ET MALWARE FormBook CnC Checkin (GET) Malware Command and Control Activity Detected
TCP 192.168.56.101:49181 -> 192.254.233.88:80 2031453 ET MALWARE FormBook CnC Checkin (GET) Malware Command and Control Activity Detected
TCP 192.168.56.101:49179 -> 43.129.164.18:80 2031412 ET MALWARE FormBook CnC Checkin (GET) Malware Command and Control Activity Detected
TCP 192.168.56.101:49179 -> 43.129.164.18:80 2031449 ET MALWARE FormBook CnC Checkin (GET) Malware Command and Control Activity Detected
TCP 192.168.56.101:49179 -> 43.129.164.18:80 2031453 ET MALWARE FormBook CnC Checkin (GET) Malware Command and Control Activity Detected
TCP 192.168.56.101:49169 -> 185.104.28.238:80 2031412 ET MALWARE FormBook CnC Checkin (GET) Malware Command and Control Activity Detected
TCP 192.168.56.101:49169 -> 185.104.28.238:80 2031449 ET MALWARE FormBook CnC Checkin (GET) Malware Command and Control Activity Detected
TCP 192.168.56.101:49169 -> 185.104.28.238:80 2031453 ET MALWARE FormBook CnC Checkin (GET) Malware Command and Control Activity Detected
TCP 192.168.56.101:49175 -> 154.204.233.149:80 2031412 ET MALWARE FormBook CnC Checkin (GET) Malware Command and Control Activity Detected
TCP 192.168.56.101:49175 -> 154.204.233.149:80 2031449 ET MALWARE FormBook CnC Checkin (GET) Malware Command and Control Activity Detected
TCP 192.168.56.101:49175 -> 154.204.233.149:80 2031453 ET MALWARE FormBook CnC Checkin (GET) Malware Command and Control Activity Detected
TCP 192.168.56.101:49189 -> 217.194.134.187:80 2031412 ET MALWARE FormBook CnC Checkin (GET) Malware Command and Control Activity Detected
TCP 192.168.56.101:49189 -> 217.194.134.187:80 2031449 ET MALWARE FormBook CnC Checkin (GET) Malware Command and Control Activity Detected
TCP 192.168.56.101:49189 -> 217.194.134.187:80 2031453 ET MALWARE FormBook CnC Checkin (GET) Malware Command and Control Activity Detected

Suricata TLS

No Suricata TLS

Time & API Arguments Status Return Repeated

GlobalMemoryStatusEx

 1 1 0
section .ndata
suspicious_features GET method with no useragent header suspicious_request GET http://www.wtwbenefitsapp.com/6tjv/?vv-9CC=ZekHcMczm1dRtokxNZDo90S9mkxwTcZYZfHK9EQ1vrBiXxapRt+GBgnIAZ7NmICX8PlBD4kZJKEGkx1iFxsaaM15ARq/tjezy4yawwM=&pq2FH=S4AijUGo
suspicious_features GET method with no useragent header suspicious_request GET http://www.ready-sim.com/6tjv/?vv-9CC=vP6NfS7dbW4c/VsB/A1JURezZpJQ8nsbdWFTlOVf6iuLILrS76/L187Vau3Zr+6SA7xbkoW8K+sU0FMWlbfewoyXotU6Wa8RuVm/2CU=&pq2FH=S4AijUGo
suspicious_features GET method with no useragent header suspicious_request GET http://www.ioddinemax.info/6tjv/?vv-9CC=fT/TJdNtCaICjnQUbIUnRDxeECYphy4YrVvAjvU+q1IskcVwc07AsJLK3tqtGnkOp8a2PyJB1vyRLc2GY7t3W09lxia7P5+VAS1NVX4=&pq2FH=S4AijUGo
suspicious_features GET method with no useragent header suspicious_request GET http://www.unrushlagos.life/6tjv/?vv-9CC=xlJUlHglSOoU+WCfb7fTPB0ne55wcB2OinDKM2+2ognpQIYysf1z9BtCtwIQWly94RFYkrYMsBdvlNEOmEGbARRcASpMTevagbuBWCs=&pq2FH=S4AijUGo
suspicious_features GET method with no useragent header suspicious_request GET http://www.innerpeasnutrition.com/6tjv/?vv-9CC=WCkonbtgklsJqt3U5AwYJ1vBQL+yzEkdXA8xucMJZCRnQC5eVhyQZD76BbsvWN4F2+2X9EJdLRzHIYbKsSuvhyO7xMyIhyiPV1yBlVw=&pq2FH=S4AijUGo
suspicious_features GET method with no useragent header suspicious_request GET http://www.fokusdongs89.click/6tjv/?vv-9CC=lddPhGieQ3lEt24wxfGSZqEKUhgeh07HzuUXm/iAUma5yHruZSDAYtghKLMKtfuJW8oz7rp+ckpMDOoMhDPkb2WQy1Gqr+rGodidlkk=&pq2FH=S4AijUGo
suspicious_features GET method with no useragent header suspicious_request GET http://www.pzr9.com/6tjv/?vv-9CC=Xe+4czuF8BNTvCl2jtutD0nc61uG19PQTHhiWjCSfHaBQ4NOq8i8K6quZY+U+HiY2tqWNVv2/OiMBhH2zz7G+0xdm39gVqvBoSlQlAk=&pq2FH=S4AijUGo
suspicious_features GET method with no useragent header suspicious_request GET http://www.subicpearlresorthotel.com/6tjv/?vv-9CC=z8EanEHhaicdSPwbUmMymlHZg3JWg4d9/pg0TpyNm6NFsGct/BtDMX7PWnf5Qsg1SQP92ELHhW5VyKkGW4ou1D5KNmy23lxxfwDNRJc=&pq2FH=S4AijUGo
suspicious_features GET method with no useragent header suspicious_request GET http://www.touslesjeudis-test2.ovh/6tjv/?vv-9CC=/1l307yFeMFeHrk4mAgZBkH4SykpTjYiA/5hCG+BMYVXlwubXDmDfEwOCf1sFfh9qMjxTdQuOFbq+mW+2MyEO3xWCYiKD3QyLOwlqdk=&pq2FH=S4AijUGo
suspicious_features GET method with no useragent header suspicious_request GET http://www.minsk-adstr.pro/6tjv/?vv-9CC=Plpwe/Vj3Si6m7s4WjkFQxqA5vT0CFMrYA9s5aV5DJ4PZlRiX3dSCC0X24ZLQNtV+tbWCzZMNx9DmPvcY1vaNPprvVENxM3YounydDs=&pq2FH=S4AijUGo
suspicious_features GET method with no useragent header suspicious_request GET http://www.jsmaiyou.com/6tjv/?vv-9CC=GT7mDBetp/BsCYP1aTCFpL/ADJtJH8x8/gvfm7l4NLF0tD2iOM8XYGcDii6V0tjr8Xc6kwylBNXtOHbYpVwzl/f1TWI72f0ir/DsOw8=&pq2FH=S4AijUGo
request POST http://www.wtwbenefitsapp.com/6tjv/
request GET http://www.wtwbenefitsapp.com/6tjv/?vv-9CC=ZekHcMczm1dRtokxNZDo90S9mkxwTcZYZfHK9EQ1vrBiXxapRt+GBgnIAZ7NmICX8PlBD4kZJKEGkx1iFxsaaM15ARq/tjezy4yawwM=&pq2FH=S4AijUGo
request GET http://www.sqlite.org/2019/sqlite-dll-win32-x86-3280000.zip
request POST http://www.ready-sim.com/6tjv/
request GET http://www.ready-sim.com/6tjv/?vv-9CC=vP6NfS7dbW4c/VsB/A1JURezZpJQ8nsbdWFTlOVf6iuLILrS76/L187Vau3Zr+6SA7xbkoW8K+sU0FMWlbfewoyXotU6Wa8RuVm/2CU=&pq2FH=S4AijUGo
request POST http://www.ioddinemax.info/6tjv/
request GET http://www.ioddinemax.info/6tjv/?vv-9CC=fT/TJdNtCaICjnQUbIUnRDxeECYphy4YrVvAjvU+q1IskcVwc07AsJLK3tqtGnkOp8a2PyJB1vyRLc2GY7t3W09lxia7P5+VAS1NVX4=&pq2FH=S4AijUGo
request POST http://www.unrushlagos.life/6tjv/
request GET http://www.unrushlagos.life/6tjv/?vv-9CC=xlJUlHglSOoU+WCfb7fTPB0ne55wcB2OinDKM2+2ognpQIYysf1z9BtCtwIQWly94RFYkrYMsBdvlNEOmEGbARRcASpMTevagbuBWCs=&pq2FH=S4AijUGo
request POST http://www.innerpeasnutrition.com/6tjv/
request GET http://www.innerpeasnutrition.com/6tjv/?vv-9CC=WCkonbtgklsJqt3U5AwYJ1vBQL+yzEkdXA8xucMJZCRnQC5eVhyQZD76BbsvWN4F2+2X9EJdLRzHIYbKsSuvhyO7xMyIhyiPV1yBlVw=&pq2FH=S4AijUGo
request POST http://www.fokusdongs89.click/6tjv/
request GET http://www.fokusdongs89.click/6tjv/?vv-9CC=lddPhGieQ3lEt24wxfGSZqEKUhgeh07HzuUXm/iAUma5yHruZSDAYtghKLMKtfuJW8oz7rp+ckpMDOoMhDPkb2WQy1Gqr+rGodidlkk=&pq2FH=S4AijUGo
request POST http://www.pzr9.com/6tjv/
request GET http://www.pzr9.com/6tjv/?vv-9CC=Xe+4czuF8BNTvCl2jtutD0nc61uG19PQTHhiWjCSfHaBQ4NOq8i8K6quZY+U+HiY2tqWNVv2/OiMBhH2zz7G+0xdm39gVqvBoSlQlAk=&pq2FH=S4AijUGo
request POST http://www.subicpearlresorthotel.com/6tjv/
request GET http://www.subicpearlresorthotel.com/6tjv/?vv-9CC=z8EanEHhaicdSPwbUmMymlHZg3JWg4d9/pg0TpyNm6NFsGct/BtDMX7PWnf5Qsg1SQP92ELHhW5VyKkGW4ou1D5KNmy23lxxfwDNRJc=&pq2FH=S4AijUGo
request POST http://www.touslesjeudis-test2.ovh/6tjv/
request GET http://www.touslesjeudis-test2.ovh/6tjv/?vv-9CC=/1l307yFeMFeHrk4mAgZBkH4SykpTjYiA/5hCG+BMYVXlwubXDmDfEwOCf1sFfh9qMjxTdQuOFbq+mW+2MyEO3xWCYiKD3QyLOwlqdk=&pq2FH=S4AijUGo
request POST http://www.minsk-adstr.pro/6tjv/
request GET http://www.minsk-adstr.pro/6tjv/?vv-9CC=Plpwe/Vj3Si6m7s4WjkFQxqA5vT0CFMrYA9s5aV5DJ4PZlRiX3dSCC0X24ZLQNtV+tbWCzZMNx9DmPvcY1vaNPprvVENxM3YounydDs=&pq2FH=S4AijUGo
request POST http://www.jsmaiyou.com/6tjv/
request GET http://www.jsmaiyou.com/6tjv/?vv-9CC=GT7mDBetp/BsCYP1aTCFpL/ADJtJH8x8/gvfm7l4NLF0tD2iOM8XYGcDii6V0tjr8Xc6kwylBNXtOHbYpVwzl/f1TWI72f0ir/DsOw8=&pq2FH=S4AijUGo
request POST http://www.wtwbenefitsapp.com/6tjv/
request POST http://www.ready-sim.com/6tjv/
request POST http://www.ioddinemax.info/6tjv/
request POST http://www.unrushlagos.life/6tjv/
request POST http://www.innerpeasnutrition.com/6tjv/
request POST http://www.fokusdongs89.click/6tjv/
request POST http://www.pzr9.com/6tjv/
request POST http://www.subicpearlresorthotel.com/6tjv/
request POST http://www.touslesjeudis-test2.ovh/6tjv/
request POST http://www.minsk-adstr.pro/6tjv/
request POST http://www.jsmaiyou.com/6tjv/
Time & API Arguments Status Return Repeated

NtProtectVirtualMemory

 process_identifier: 2552
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x732a2000
process_handle: 0xffffffff
1 0 0

NtProtectVirtualMemory

 process_identifier: 2552
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 8192
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x73953000
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2552
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x02020000
allocation_type: 12289 (MEM_COMMIT|MEM_RESERVE)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2652
region_size: 3158016
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x00820000
allocation_type: 12288 (MEM_COMMIT|MEM_RESERVE)
process_handle: 0xffffffff
1 0 0
file C:\Users\test22\AppData\Local\Temp\nscF08C.tmp\zqsexr.dll
file C:\Users\test22\AppData\Local\Temp\nscF08C.tmp\zqsexr.dll
Time & API Arguments Status Return Repeated

LookupPrivilegeValueW

 system_name:
privilege_name: SeDebugPrivilege
1 1 0
Process injection Process 2552 called NtSetContextThread to modify thread in remote process 2652
Time & API Arguments Status Return Repeated

NtSetContextThread

 registers.eip: 1995571652
registers.esp: 1638384
registers.edi: 0
registers.eax: 4199408
registers.ebp: 0
registers.edx: 0
registers.ebx: 2130567168
registers.esi: 0
registers.ecx: 0
thread_handle: 0x00000218
process_identifier: 2652
1 0 0
Bkav W32.AIDetectMalware
Lionic Trojan.Win32.Agent.tshg
Elastic malicious (high confidence)
MicroWorld-eScan Gen:Variant.Nemesis.25268
FireEye Generic.mg.2bdd38681778a2be
McAfee RDN/Generic.dx
Malwarebytes Trojan.Injector.NSIS
Sangfor Trojan.Win32.Injector.Vsw0
Cybereason malicious.81778a
Arcabit Trojan.Nemesis.D62B4 [many]
Cyren W32/Injector.BOS.gen!Eldorado
Symantec Trojan Horse
ESET-NOD32 a variant of Win32/Injector.ETCV
Cynet Malicious (score: 100)
APEX Malicious
Kaspersky Trojan.Win32.Strab.bup
BitDefender Gen:Variant.Nemesis.25268
Avast Win32:InjectorX-gen [Trj]
Emsisoft Gen:Variant.Nemesis.25268 (B)
F-Secure Heuristic.HEUR/AGEN.1300644
VIPRE Gen:Variant.Nemesis.25268
McAfee-GW-Edition BehavesLike.Win32.Generic.dc
Trapmine malicious.moderate.ml.score
Sophos Mal/Generic-S
SentinelOne Static AI - Suspicious PE
Webroot W32.Infostealer.Formbook
Avira HEUR/AGEN.1300644
MAX malware (ai score=85)
Microsoft Trojan:Win32/Casdet!rfn
ZoneAlarm HEUR:Trojan-Spy.Win32.Noon.gen
GData Zum.Androm.1
Google Detected
AhnLab-V3 Trojan/Win.Generic.R585815
Acronis suspicious
Cylance unsafe
Panda Trj/Chgt.AD
TrendMicro-HouseCall TROJ_GEN.R002H0DGH23
Rising Trojan.Injector!1.E835 (CLASSIC)
Ikarus Trojan.Win32.Injector
Fortinet NSIS/Agent.DCAC!tr
AVG Win32:InjectorX-gen [Trj]
DeepInstinct MALICIOUS
CrowdStrike win/malicious_confidence_100% (W)