Summary | ZeroBOX

Category	Machine	Started	Completed
FILE	s1_win7_x6403_us	July 25, 2023, 7:31 a.m.	July 25, 2023, 7:35 a.m.

Size	168.6KB
Type	PE32 executable (GUI) Intel 80386, for MS Windows, Nullsoft Installer self-extracting archive
MD5	`39bd04b9ae7385809776dc4bad0eb9ff`
SHA256	`4375effcba6110d4f5c6d3d7839ef0d1c33b024f802a589af532b969ae679fd4`
CRC32	`2197237E`
ssdeep	`3072:XfY/TU9fE9PEtu64bZmCsNs4bqVflVc/nABPTosmBLymfAkyZPqRRG:PYa6/ZmC0qJlVc/ABrosmBzmkXG`
Yara	UPX_Zero - UPX packed file NSIS_Installer - Null Soft Installer Malicious_Library_Zero - Malicious_Library PE_Header_Zero - PE File Signature IsPE32 - (no description)

r8LO6JsBFr.exe "C:\Users\test22\AppData\Local\Temp\r8LO6JsBFr.exe"
1804
- r8LO6JsBFr.exe "C:\Users\test22\AppData\Local\Temp\r8LO6JsBFr.exe"
  2076
explorer.exe C:\Windows\Explorer.EXE
1236

Name	Response	Post-Analysis Lookup
patront.duckdns.org	A 85.208.139.45	85.208.139.45

IP Address	Status	Action
164.124.101.2	Active	Moloch
85.208.139.45	Active	Moloch

Flow	SID	Signature	Category
UDP 192.168.56.103:52760 -> 164.124.101.2:53	2042936	ET INFO DYNAMIC_DNS Query to a *.duckdns .org Domain	Potentially Bad Traffic
UDP 192.168.56.103:52760 -> 164.124.101.2:53	2022918	ET INFO DYNAMIC_DNS Query to *.duckdns. Domain	Misc activity
TCP 85.208.139.45:8520 -> 192.168.56.103:49166	2036735	ET MALWARE Ave Maria/Warzone RAT Encrypted CnC Checkin (Inbound)	Malware Command and Control Activity Detected
TCP 192.168.56.103:49166 -> 85.208.139.45:8520	2036734	ET MALWARE Ave Maria/Warzone RAT Encrypted CnC Checkin	Malware Command and Control Activity Detected

No Suricata TLS

Time & API	Arguments	Status	Return	Repeated
GetComputerNameW July 25, 2023, 7:31 a.m.	computer_name: TEST22-PC	1	1	0

registry

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\MachineGuid

Time & API	Arguments	Status	Return	Repeated
GlobalMemoryStatusEx July 25, 2023, 7:31 a.m.		1	1	0

section

.ndata

domain

patront.duckdns.org

Time & API	Arguments	Status
NtProtectVirtualMemory July 25, 2023, 7:31 a.m.	process_identifier: 1804 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 8192 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x741cb000 process_handle: 0xffffffff	1
NtAllocateVirtualMemory July 25, 2023, 7:31 a.m.	process_identifier: 1804 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x02f40000 allocation_type: 12289 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0xffffffff	1
NtAllocateVirtualMemory July 25, 2023, 7:24 a.m.	process_identifier: 1236 region_size: 65536 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0000000004d10000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1

file	C:\Users\test22\AppData\Local\Temp\nsbC2DF.tmp\yzgmy.dll
file	C:\Users\test22\AppData\Roaming\glueai\rnwsclhqavf.exe

file	C:\Users\test22\AppData\Roaming\glueai\rnwsclhqavf.exe
file	C:\Users\test22\AppData\Local\Temp\nsbC2DF.tmp\yzgmy.dll

reg_key

HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run\bktp

reg_value

C:\Users\test22\AppData\Roaming\glueai\rnwsclhqavf.exe "C:\Users\test22\AppData\Local\Temp\r8LO6JsBFr.exe"

Time & API	Arguments	Status	Return	Repeated
SetWindowsHookExA July 25, 2023, 7:31 a.m.	thread_identifier: 0 callback_function: 0x004074c0 hook_identifier: 13 (WH_KEYBOARD_LL) module_address: 0x00400000	1	131537	0

Time & API	Arguments	Status	Return	Repeated
Process injection	Process 1804 called NtSetContextThread to modify thread in remote process 2076
NtSetContextThread July 25, 2023, 7:31 a.m.	registers.eip: 2005598660 registers.esp: 1638384 registers.edi: 0 registers.eax: 4216632 registers.ebp: 0 registers.edx: 0 registers.ebx: 2130567168 registers.esi: 0 registers.ecx: 0 thread_handle: 0x00000230 process_identifier: 2076	1	0	0

r8LO6JsBFr.exe