popup
Summary | ZeroBOX
  1. Home
  2. Result
  3. Report
  4. Detail Analysis

O77vNQG6.exe

UPX Malicious Library Malicious Packer PE File OS Processor Check JPEG Format PE32
  1. Resubmit sample
Category Machine Started Completed
FILE s1_win7_x6403_us Aug. 7, 2023, 9:09 a.m. Aug. 7, 2023, 9:11 a.m.
Size 231.0KB
Type PE32 executable (GUI) Intel 80386, for MS Windows
MD5 90e1482208611ebf4b36413d6bf05f42
SHA256 0e41ffd44bc8a085a3bd49058ff0051538476c8a05f086593b02bc87b30268dc
CRC32 1BA51FB9
ssdeep 3072:eSO3Te83mI75HrE+kqQUULV5J3T1XiRuiibP5o/l7RSKFyLiJGu7dqvyEzkzwkr8:se83mQ4LBVvZT1ilF/WKFrGu7duMAVa
PDB Path D:\Mktmp\Amadey\Release\Amadey.pdb
Yara
  • UPX_Zero - UPX packed file
  • OS_Processor_Check_Zero - OS Processor Check
  • Malicious_Library_Zero - Malicious_Library
  • PE_Header_Zero - PE File Signature
  • Malicious_Packer_Zero - Malicious Packer
  • IsPE32 - (no description)

Name Response Post-Analysis Lookup
xyl.lat
IP Address Status Action
164.124.101.2 Active Moloch

Suricata Alerts

No Suricata Alerts

Suricata TLS

No Suricata TLS

Time & API Arguments Status Return Repeated

GetComputerNameW

 computer_name: TEST22-PC
1 1 0
Time & API Arguments Status Return Repeated

WriteConsoleW

 buffer: SUCCESS: The scheduled task "bstyoops.exe" has successfully been created.
console_handle: 0x00000007
1 1 0

WriteConsoleA

 buffer: A
console_handle: 0x00000007
1 1 0

WriteConsoleA

 buffer: r
console_handle: 0x00000007
1 1 0

WriteConsoleA

 buffer: e
console_handle: 0x00000007
1 1 0

WriteConsoleA

 buffer: y
console_handle: 0x00000007
1 1 0

WriteConsoleA

 buffer: o
console_handle: 0x00000007
1 1 0

WriteConsoleA

 buffer: u
console_handle: 0x00000007
1 1 0

WriteConsoleA

 buffer: s
console_handle: 0x00000007
1 1 0

WriteConsoleA

 buffer: u
console_handle: 0x00000007
1 1 0

WriteConsoleA

 buffer: r
console_handle: 0x00000007
1 1 0

WriteConsoleA

 buffer: e
console_handle: 0x00000007
1 1 0

WriteConsoleA

 buffer: Y
console_handle: 0x00000007
1 1 0

WriteConsoleA

 buffer: N
console_handle: 0x00000007
1 1 0

WriteConsoleA

 buffer: p
console_handle: 0x00000007
1 1 0

WriteConsoleA

 buffer: r
console_handle: 0x00000007
1 1 0

WriteConsoleA

 buffer: o
console_handle: 0x00000007
1 1 0

WriteConsoleA

 buffer: c
console_handle: 0x00000007
1 1 0

WriteConsoleA

 buffer: e
console_handle: 0x00000007
1 1 0

WriteConsoleA

 buffer: s
console_handle: 0x00000007
1 1 0

WriteConsoleA

 buffer: s
console_handle: 0x00000007
1 1 0

WriteConsoleA

 buffer: e
console_handle: 0x00000007
1 1 0

WriteConsoleA

 buffer: d
console_handle: 0x00000007
1 1 0

WriteConsoleA

 buffer: f
console_handle: 0x00000007
1 1 0

WriteConsoleA

 buffer: i
console_handle: 0x00000007
1 1 0

WriteConsoleA

 buffer: l
console_handle: 0x00000007
1 1 0

WriteConsoleA

 buffer: e
console_handle: 0x00000007
1 1 0

WriteConsoleW

 buffer: C:\Users\test22\AppData\Local\Temp\b6ba12ff32\bstyoops.exe
console_handle: 0x00000007
1 1 0

WriteConsoleA

 buffer: p
console_handle: 0x00000007
1 1 0

WriteConsoleA

 buffer: r
console_handle: 0x00000007
1 1 0

WriteConsoleA

 buffer: o
console_handle: 0x00000007
1 1 0

WriteConsoleA

 buffer: c
console_handle: 0x00000007
1 1 0

WriteConsoleA

 buffer: e
console_handle: 0x00000007
1 1 0

WriteConsoleA

 buffer: s
console_handle: 0x00000007
1 1 0

WriteConsoleA

 buffer: s
console_handle: 0x00000007
1 1 0

WriteConsoleA

 buffer: e
console_handle: 0x00000007
1 1 0

WriteConsoleA

 buffer: d
console_handle: 0x00000007
1 1 0

WriteConsoleA

 buffer: f
console_handle: 0x00000007
1 1 0

WriteConsoleA

 buffer: i
console_handle: 0x00000007
1 1 0

WriteConsoleA

 buffer: l
console_handle: 0x00000007
1 1 0

WriteConsoleA

 buffer: e
console_handle: 0x00000007
1 1 0

WriteConsoleW

 buffer: C:\Users\test22\AppData\Local\Temp\b6ba12ff32\bstyoops.exe
console_handle: 0x00000007
1 1 0

WriteConsoleA

 buffer: A
console_handle: 0x00000007
1 1 0

WriteConsoleA

 buffer: r
console_handle: 0x00000007
1 1 0

WriteConsoleA

 buffer: e
console_handle: 0x00000007
1 1 0

WriteConsoleA

 buffer: y
console_handle: 0x00000007
1 1 0

WriteConsoleA

 buffer: o
console_handle: 0x00000007
1 1 0

WriteConsoleA

 buffer: u
console_handle: 0x00000007
1 1 0

WriteConsoleA

 buffer: s
console_handle: 0x00000007
1 1 0

WriteConsoleA

 buffer: u
console_handle: 0x00000007
1 1 0

WriteConsoleA

 buffer: r
console_handle: 0x00000007
1 1 0
pdb_path D:\Mktmp\Amadey\Release\Amadey.pdb
Time & API Arguments Status Return Repeated

GlobalMemoryStatusEx

 1 1 0
Time & API Arguments Status Return Repeated

NtAllocateVirtualMemory

 process_identifier: 792
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x02100000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 1236
region_size: 65536
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x0000000006700000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffffffffffff
1 0 0
description bstyoops.exe tried to sleep 141 seconds, actually delayed analysis time by 141 seconds
cmdline SCHTASKS /Create /SC MINUTE /MO 1 /TN bstyoops.exe /TR "C:\Users\test22\AppData\Local\Temp\b6ba12ff32\bstyoops.exe" /F
cmdline "C:\Windows\System32\cmd.exe" /k echo Y|CACLS "bstyoops.exe" /P "test22:N"&&CACLS "bstyoops.exe" /P "test22:R" /E&&echo Y|CACLS "..\b6ba12ff32" /P "test22:N"&&CACLS "..\b6ba12ff32" /P "test22:R" /E&&Exit
cmdline C:\Windows\system32\cmd.exe /S /D /c" echo Y"
cmdline "C:\Windows\System32\schtasks.exe" /Create /SC MINUTE /MO 1 /TN bstyoops.exe /TR "C:\Users\test22\AppData\Local\Temp\b6ba12ff32\bstyoops.exe" /F
file C:\Users\test22\AppData\Local\Temp\b6ba12ff32\bstyoops.exe
file C:\Users\test22\AppData\Local\Temp\b6ba12ff32\bstyoops.exe
Time & API Arguments Status Return Repeated

ShellExecuteExW

 show_type: 0
filepath_r: C:\Users\test22\AppData\Local\Temp\b6ba12ff32\bstyoops.exe
parameters:
filepath: C:\Users\test22\AppData\Local\Temp\b6ba12ff32\bstyoops.exe
1 1 0

ShellExecuteExW

 show_type: 0
filepath_r: SCHTASKS
parameters: /Create /SC MINUTE /MO 1 /TN bstyoops.exe /TR "C:\Users\test22\AppData\Local\Temp\b6ba12ff32\bstyoops.exe" /F
filepath: SCHTASKS
1 1 0

ShellExecuteExW

 show_type: 0
filepath_r: cmd
parameters: /k echo Y|CACLS "bstyoops.exe" /P "test22:N"&&CACLS "bstyoops.exe" /P "test22:R" /E&&echo Y|CACLS "..\b6ba12ff32" /P "test22:N"&&CACLS "..\b6ba12ff32" /P "test22:R" /E&&Exit
filepath: cmd
1 1 0
cmdline SCHTASKS /Create /SC MINUTE /MO 1 /TN bstyoops.exe /TR "C:\Users\test22\AppData\Local\Temp\b6ba12ff32\bstyoops.exe" /F
cmdline "C:\Windows\System32\schtasks.exe" /Create /SC MINUTE /MO 1 /TN bstyoops.exe /TR "C:\Users\test22\AppData\Local\Temp\b6ba12ff32\bstyoops.exe" /F
file C:\ProgramData\AVAST Software
file C:\ProgramData\Avira
file C:\ProgramData\Kaspersky Lab
file C:\ProgramData\Panda Security
file C:\ProgramData\Bitdefender
file C:\ProgramData\AVG
file C:\ProgramData\Doctor Web
cmdline SCHTASKS /Create /SC MINUTE /MO 1 /TN bstyoops.exe /TR "C:\Users\test22\AppData\Local\Temp\b6ba12ff32\bstyoops.exe" /F
cmdline "C:\Windows\System32\schtasks.exe" /Create /SC MINUTE /MO 1 /TN bstyoops.exe /TR "C:\Users\test22\AppData\Local\Temp\b6ba12ff32\bstyoops.exe" /F
Time & API Arguments Status Return Repeated

RegSetValueExA

 key_handle: 0x00000324
regkey_r: ProxyEnable
reg_type: 4 (REG_DWORD)
value: 0
regkey: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ProxyEnable
1 0 0
cmdline CACLS "..\b6ba12ff32" /P "test22:R" /E
cmdline CACLS "bstyoops.exe" /P "test22:R" /E
cmdline CACLS "bstyoops.exe" /P "test22:N"
cmdline "C:\Windows\System32\cmd.exe" /k echo Y|CACLS "bstyoops.exe" /P "test22:N"&&CACLS "bstyoops.exe" /P "test22:R" /E&&echo Y|CACLS "..\b6ba12ff32" /P "test22:N"&&CACLS "..\b6ba12ff32" /P "test22:R" /E&&Exit
cmdline cmd /k echo Y|CACLS "bstyoops.exe" /P "test22:N"&&CACLS "bstyoops.exe" /P "test22:R" /E&&echo Y|CACLS "..\b6ba12ff32" /P "test22:N"&&CACLS "..\b6ba12ff32" /P "test22:R" /E&&Exit
cmdline CACLS "..\b6ba12ff32" /P "test22:N"
Bkav W32.AIDetectMalware
Elastic Windows.Trojan.Amadey
Cynet Malicious (score: 100)
McAfee Downloader-FCND!90E148220861
Cylance unsafe
Sangfor Suspicious.Win32.Save.a
K7AntiVirus Trojan ( 005a7a4a1 )
Alibaba TrojanDownloader:Win32/Amadey.3586b182
K7GW Trojan ( 005a7a4a1 )
Cybereason malicious.208611
Cyren W32/Amadey.C1.gen!Eldorado
Symantec ML.Attribute.HighConfidence
ESET-NOD32 a variant of Win32/TrojanDownloader.Amadey.A
APEX Malicious
ClamAV Win.Malware.Doina-10001799-0
Kaspersky HEUR:Trojan-Downloader.Win32.Deyma.gen
BitDefender Gen:Variant.Doina.60896
MicroWorld-eScan Gen:Variant.Doina.60896
Avast Win32:BotX-gen [Trj]
Rising Spyware.Agent!8.C6 (TFE:5:Ff7t0kYd78J)
Emsisoft Gen:Variant.Doina.60896 (B)
F-Secure Heuristic.HEUR/AGEN.1319380
VIPRE Gen:Variant.Doina.60896
TrendMicro Trojan.Win32.AMADEY.YXDHEZ
McAfee-GW-Edition BehavesLike.Win32.Generic.dh
FireEye Generic.mg.90e1482208611ebf
Sophos Mal/Generic-R
SentinelOne Static AI - Malicious PE
GData Gen:Variant.Doina.60896
Avira HEUR/AGEN.1319380
MAX malware (ai score=88)
Antiy-AVL Trojan[Downloader]/Win32.Amadey
Arcabit Trojan.Doina.DEDE0
ZoneAlarm HEUR:Trojan-Downloader.Win32.Deyma.gen
Microsoft Trojan:Win32/Amadey.RDH!MTB
Google Detected
AhnLab-V3 Malware/Win.Trojanspy.C5238800
BitDefenderTheta Gen:NN.ZexaF.36348.ouW@amEIRFpi
ALYac Gen:Variant.Doina.60896
Malwarebytes Backdoor.Amadey
Panda Trj/Genetic.gen
TrendMicro-HouseCall Trojan.Win32.AMADEY.YXDHEZ
Tencent Win32.Trojan.Agen.Ddhl
Ikarus Trojan-Downloader.Win32.Amadey
MaxSecure Trojan.Malware.300983.susgen
Fortinet W32/Amadey.A!tr
AVG Win32:BotX-gen [Trj]
DeepInstinct MALICIOUS
CrowdStrike win/malicious_confidence_100% (W)