Favorites
Tools
Dr.Zero Chatbot
Notifications
Guide 2020-06-10
Version history 2020-06-10

Summary | ZeroBOX

install-alevrola.exe

Generic Malware Malicious Library UPX GIF Format PNG Format MZP Format PE File PE32

Category	Machine	Started	Completed
FILE	s1_win7_x6402	July 24, 2023, 9:10 a.m.	July 24, 2023, 9:12 a.m.

Size	1.9MB
Type	PE32 executable (GUI) Intel 80386, for MS Windows, Nullsoft Installer self-extracting archive
MD5	`8d6d682cbd51a88075c184966aa0de17`
SHA256	`23c4264ba50fd5d23c28dc1d20ddff78e90fa4d80464b01a522c2acea3a47f37`
CRC32	`574CB1CE`
ssdeep	`49152:dbgVRyoQy3/CKsjkmQaHcc2AVyY17ImirKmwaOAi:d29QRpkmQC2L+72rKmG`
Yara	Malicious_Library_Zero - Malicious_Library PE_Header_Zero - PE File Signature IsPE32 - (no description)

install-alevrola.exe "C:\Users\test22\AppData\Local\Temp\install-alevrola.exe"
3008
- ccagent.exe C:\Users\test22\AppData\Roaming\ACommander\ccagent.exe
  2200
explorer.exe C:\Windows\Explorer.EXE
1236

Name	Response	Post-Analysis Lookup
No hosts contacted.

IP Address	Status	Action
176.113.115.135	Active	Moloch
176.113.115.136	Active	Moloch
176.113.115.84	Active	Moloch
176.113.115.85	Active	Moloch
164.124.101.2	Active	Moloch
213.91.128.133	Active	Moloch
45.143.201.238	Active	Moloch
62.122.184.92	Active	Moloch
80.66.75.4	Active	Moloch

Suricata Alerts

Flow	SID	Signature	Category
TCP 62.122.184.92:431 -> 192.168.56.102:49279	2402000	ET DROP Dshield Block Listed Source group 1	Misc Attack
TCP 176.113.115.136:431 -> 192.168.56.102:49284	2400021	ET DROP Spamhaus DROP Listed Traffic Inbound group 22	Misc Attack
TCP 176.113.115.135:431 -> 192.168.56.102:49283	2400021	ET DROP Spamhaus DROP Listed Traffic Inbound group 22	Misc Attack
TCP 176.113.115.85:431 -> 192.168.56.102:49285	2400021	ET DROP Spamhaus DROP Listed Traffic Inbound group 22	Misc Attack
TCP 176.113.115.84:431 -> 192.168.56.102:49281	2400021	ET DROP Spamhaus DROP Listed Traffic Inbound group 22	Misc Attack

Suricata TLS

No Suricata TLS

Queries for the computername (2 events)

Time & API	Arguments	Status	Return	Repeated
GetComputerNameW July 24, 2023, 9:10 a.m.	computer_name: TEST22-PC	1	1	0
GetComputerNameW July 24, 2023, 9:10 a.m.	computer_name: TEST22-PC	1	1	0

Checks amount of memory in system, this can be used to detect virtual machines that have a low amount of memory available (1 event)

Time & API	Arguments	Status	Return	Repeated
GlobalMemoryStatusEx July 24, 2023, 9:10 a.m.		1	1	0

The executable contains unknown PE section names indicative of a packer (could be a false positive) (1 event)

section

.ndata

Allocates read-write-execute memory (usually to unpack itself) (18 events)

Time & API	Arguments	Status	Return	Repeated
NtProtectVirtualMemory July 24, 2023, 9:10 a.m.	process_identifier: 3008 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x73ef1000 process_handle: 0xffffffff	1	0	0
NtProtectVirtualMemory July 24, 2023, 9:10 a.m.	process_identifier: 3008 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x73dc1000 process_handle: 0xffffffff	1	0	0
NtProtectVirtualMemory July 24, 2023, 9:10 a.m.	process_identifier: 3008 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x75231000 process_handle: 0xffffffff	1	0	0
NtProtectVirtualMemory July 24, 2023, 9:10 a.m.	process_identifier: 3008 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x73ce1000 process_handle: 0xffffffff	1	0	0
NtProtectVirtualMemory July 24, 2023, 9:10 a.m.	process_identifier: 3008 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x73c01000 process_handle: 0xffffffff	1	0	0
NtProtectVirtualMemory July 24, 2023, 9:10 a.m.	process_identifier: 3008 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x73b51000 process_handle: 0xffffffff	1	0	0
NtProtectVirtualMemory July 24, 2023, 9:10 a.m.	process_identifier: 3008 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x73c02000 process_handle: 0xffffffff	1	0	0
NtProtectVirtualMemory July 24, 2023, 9:10 a.m.	process_identifier: 3008 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x73cb1000 process_handle: 0xffffffff	1	0	0
NtProtectVirtualMemory July 24, 2023, 9:10 a.m.	process_identifier: 3008 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x73cb3000 process_handle: 0xffffffff	1	0	0
NtProtectVirtualMemory July 24, 2023, 9:10 a.m.	process_identifier: 3008 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x73ca1000 process_handle: 0xffffffff	1	0	0
NtProtectVirtualMemory July 24, 2023, 9:10 a.m.	process_identifier: 3008 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x73901000 process_handle: 0xffffffff	1	0	0
NtProtectVirtualMemory July 24, 2023, 9:10 a.m.	process_identifier: 3008 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x73c81000 process_handle: 0xffffffff	1	0	0
NtProtectVirtualMemory July 24, 2023, 9:10 a.m.	process_identifier: 3008 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x738f1000 process_handle: 0xffffffff	1	0	0
NtAllocateVirtualMemory July 24, 2023, 9:11 a.m.	process_identifier: 1236 region_size: 65536 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0000000007790000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1	0	0
NtProtectVirtualMemory July 24, 2023, 9:10 a.m.	process_identifier: 2200 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x74241000 process_handle: 0xffffffff	1	0	0
NtProtectVirtualMemory July 24, 2023, 9:10 a.m.	process_identifier: 2200 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x74191000 process_handle: 0xffffffff	1	0	0
NtProtectVirtualMemory July 24, 2023, 9:10 a.m.	process_identifier: 2200 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x74242000 process_handle: 0xffffffff	1	0	0
NtAllocateVirtualMemory July 24, 2023, 9:10 a.m.	process_identifier: 2200 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x003e0000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1	0	0

Queries the disk size which could be used to detect virtual machine with small fixed size or dynamic allocation (1 event)

Time & API	Arguments	Status	Return	Repeated
GetDiskFreeSpaceExW July 24, 2023, 9:10 a.m.	total_number_of_free_bytes: 0 free_bytes_available: 9118658560 root_path: C:\Users\test22\AppData\Local\Microsoft\Windows\Explorer total_number_of_bytes: 0	1	1	0

Creates executable files on the filesystem (4 events)

file	C:\Users\test22\AppData\Roaming\ACommander\ccmain.exe
file	C:\Users\test22\AppData\Roaming\ACommander\uninstall.exe
file	C:\Users\test22\Desktop\ACommander.lnk
file	C:\Users\test22\AppData\Roaming\ACommander\ccagent.exe

Creates a shortcut to an executable file (1 event)

file	C:\Users\test22\Desktop\ACommander.lnk

Drops an executable to the user AppData folder (3 events)

file	C:\Users\test22\AppData\Roaming\ACommander\ccmain.exe
file	C:\Users\test22\AppData\Roaming\ACommander\ccagent.exe
file	C:\Users\test22\AppData\Roaming\ACommander\uninstall.exe

Communicates with host for which no DNS query was performed (8 events)

host	176.113.115.135
host	176.113.115.136
host	176.113.115.84
host	176.113.115.85
host	213.91.128.133
host	45.143.201.238
host	62.122.184.92
host	80.66.75.4

Installs itself for autorun at Windows startup (2 events)

reg_key	HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run\ccagent.exe				reg_value	C:\Users\test22\AppData\Roaming\ACommander\ccagent.exe
reg_key	HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell				reg_value	C:\Users\test22\AppData\Roaming\ACommander\ccmain.exe