popup
Summary | ZeroBOX
  1. Home
  2. Result
  3. Report
  4. Detail Analysis

Pass1234_file.7z

Vidar PWS Escalate priviledges KeyLogger AntiDebug AntiVM
  1. Resubmit sample
Category Machine Started Completed
FILE s1_win7_x6402 Aug. 9, 2023, 1:37 p.m. Aug. 9, 2023, 1:39 p.m.
Size 3.9MB
Type 7-zip archive data, version 0.4
MD5 8c849c3860d4cde88ae04546492f17dc
SHA256 e25da9c7ffa4dbf78f611136ef2845e184e22590e299fd812948b8e3e6b18c77
CRC32 A4CFABA4
ssdeep 98304:DZsZ9oVA+N0pt4sJvirJCwtZUNrR+G5JHq4eDeq/u+Of5Hof6rD:1DP4akEowtZUJHqN/u+w5O6X
Yara None matched

Name Response Post-Analysis Lookup
zzz.fhauiehgha.com
A 156.236.72.121
156.236.72.121
iplogger.org
A 148.251.234.83
148.251.234.83
vk.com
A 87.240.129.133
A 87.240.132.72
A 87.240.132.78
A 87.240.137.164
A 93.186.225.194
A 87.240.132.67
93.186.225.194
vanaheim.cn
A 77.232.41.127
77.232.41.127
iplis.ru
A 148.251.234.93
148.251.234.93
apps.identrust.com
CNAME identrust.edgesuite.net
CNAME a1952.dscq.akamai.net
A 23.67.53.17
A 23.67.53.18
23.67.53.17
busell.store
A 172.67.159.178
A 104.21.9.89
172.67.159.178
aa.imgjeoogbb.com
A 154.221.26.108
154.221.26.108
sun6-20.userapi.com
A 95.142.206.0
95.142.206.0
ipinfo.io
A 34.117.59.81
34.117.59.81
steamcommunity.com
A 104.76.78.101
104.76.78.101
hugersi.com
A 91.215.85.147
91.215.85.147
t.me
A 149.154.167.99
149.154.167.99
www.maxmind.com
A 104.17.215.67
A 104.17.214.67
104.17.214.67
db-ip.com
A 172.67.75.166
A 104.26.5.15
A 104.26.4.15
104.26.5.15
api.db-ip.com
A 104.26.4.15
A 172.67.75.166
A 104.26.5.15
104.26.4.15
us.imgjeoigaa.com
A 103.100.211.218
103.100.211.218
sun6-23.userapi.com
A 95.142.206.3
95.142.206.3
sun6-21.userapi.com
A 95.142.206.1
95.142.206.1
fastpool.xyz
A 213.91.128.133
213.91.128.133
api.myip.com
A 172.67.75.163
A 104.26.9.59
A 104.26.8.59
104.26.8.59
IP Address Status Action
103.100.211.218 Active Moloch
104.17.214.67 Active Moloch
104.21.9.89 Active Moloch
104.26.4.15 Active Moloch
104.76.78.101 Active Moloch
148.251.234.83 Active Moloch
148.251.234.93 Active Moloch
149.154.167.99 Active Moloch
154.221.26.108 Active Moloch
156.236.72.121 Active Moloch
163.123.143.4 Active Moloch
164.124.101.2 Active Moloch
172.67.75.163 Active Moloch
172.67.75.166 Active Moloch
176.113.115.84 Active Moloch
176.123.9.142 Active Moloch
185.225.73.32 Active Moloch
193.233.254.61 Active Moloch
194.26.135.162 Active Moloch
208.67.104.60 Active Moloch
209.250.248.11 Active Moloch
213.91.128.133 Active Moloch
23.67.53.17 Active Moloch
34.117.59.81 Active Moloch
45.15.156.229 Active Moloch
62.122.184.58 Active Moloch
65.21.187.146 Active Moloch
77.232.41.127 Active Moloch
77.91.124.231 Active Moloch
77.91.124.54 Active Moloch
77.91.68.61 Active Moloch
85.208.136.10 Active Moloch
87.121.221.58 Active Moloch
87.240.132.78 Active Moloch
91.215.85.147 Active Moloch
94.142.138.131 Active Moloch
95.142.206.0 Active Moloch
95.142.206.1 Active Moloch
95.142.206.3 Active Moloch
95.214.25.207 Active Moloch

Suricata Alerts

No Suricata Alerts

Suricata TLS

No Suricata TLS

Time & API Arguments Status Return Repeated

IsDebuggerPresent

 0 0
Time & API Arguments Status Return Repeated

GlobalMemoryStatusEx

 1 1 0
suspicious_features Connection to IP address suspicious_request GET http://94.142.138.131/api/tracemap.php
suspicious_features POST method with no referer header, Connection to IP address suspicious_request POST http://94.142.138.131/api/firegate.php
suspicious_features Connection to IP address suspicious_request HEAD http://77.91.124.231/info/photo443.exe
suspicious_features Connection to IP address suspicious_request HEAD http://87.121.221.58/g.exe
suspicious_features Connection to IP address suspicious_request GET http://87.121.221.58/g.exe
suspicious_features Connection to IP address suspicious_request GET http://77.91.124.231/info/photo443.exe
suspicious_features Connection to IP address suspicious_request GET http://176.113.115.84:8080/4.php
suspicious_features POST method with no referer header suspicious_request POST http://aa.imgjeoogbb.com/check/?sid=294936&key=d9eb18658941edfb01ef7f4e4f3bcf60
suspicious_features Connection to IP address suspicious_request GET http://45.15.156.229/api/tracemap.php
suspicious_features Connection to IP address suspicious_request GET http://208.67.104.60/api/tracemap.php
suspicious_features Connection to IP address suspicious_request GET http://65.21.187.146/43a6ce95ca0edbaf09babc2b3d43fe58
suspicious_features Connection to IP address suspicious_request GET http://65.21.187.146/files.zip
suspicious_features POST method with no referer header, POST method with no useragent header, Connection to IP address suspicious_request POST http://77.91.68.61/rock/index.php
suspicious_features POST method with no referer header, Connection to IP address suspicious_request POST http://65.21.187.146/
suspicious_features POST method with no referer header, Connection to IP address suspicious_request POST http://193.233.254.61/loghub/master
request GET http://94.142.138.131/api/tracemap.php
request POST http://94.142.138.131/api/firegate.php
request HEAD http://77.91.124.231/info/photo443.exe
request HEAD http://87.121.221.58/g.exe
request GET http://87.121.221.58/g.exe
request GET http://77.91.124.231/info/photo443.exe
request HEAD http://hugersi.com/dl/6523.exe
request HEAD http://zzz.fhauiehgha.com/m/okka25.exe
request GET http://zzz.fhauiehgha.com/m/okka25.exe
request GET http://176.113.115.84:8080/4.php
request GET http://apps.identrust.com/roots/dstrootcax3.p7c
request GET http://hugersi.com/dl/6523.exe
request GET http://us.imgjeoigaa.com/sts/imagc.jpg
request GET http://aa.imgjeoogbb.com/check/safe
request POST http://aa.imgjeoogbb.com/check/?sid=294936&key=d9eb18658941edfb01ef7f4e4f3bcf60
request GET http://45.15.156.229/api/tracemap.php
request GET http://208.67.104.60/api/tracemap.php
request GET http://www.maxmind.com/geoip/v2.1/city/me
request GET http://65.21.187.146/43a6ce95ca0edbaf09babc2b3d43fe58
request GET http://65.21.187.146/files.zip
request POST http://77.91.68.61/rock/index.php
request POST http://65.21.187.146/
request POST http://193.233.254.61/loghub/master
request GET https://api.myip.com/
request GET https://vk.com/doc746114504_647280747?hash=cvDFKP5q0CQEjBCbeoeHvPNrWE0xbMxZEmrkIeNKcET&dl=G42DMMJRGQ2TANA:1661413520:uZNj68vRUvQaydRD8wpAK8zluN0I7otw5AHbA1ZlN9T&api=1&no_preview=1
request GET https://busell.store/setup294.exe
request GET https://vk.com/doc791620691_663065029?hash=Efubo9FQtw3Bdj42XJVcJwymfIH3PazMKz8g5wJ0dZX&dl=G44TCNRSGA3DSMI:1682787066:QgrgzF33wDt9bwmmOgWCYTv61J7HwhLVZOXGaEdWiKP&api=1&no_preview=1#test
request GET https://vk.com/doc801981293_667454987?hash=kPpi9bC3rv9q7iZDCWdCIDMK6XFt1NWknu5RxXyxZST&dl=slQ3yZBhbXAyX5QrjOWy1faytAkizWc5WCVP1enGF7H&api=1&no_preview=1
request GET https://sun6-23.userapi.com/c240331/u801981293/docs/d56/dab33f053e7c/PMmp.bmp?extra=a4Cg8XIbUtZZBJyBQCMW4u__V4MU2I7W7NYiQS3KlkgLS1hFGI4dFSeDqItPwxD9iGpDcky1Bw9Ddc2BJudwVjTqCJRs2To8Eqgtk_3_Zl4z_IY4-X2B8ePuzB7q8vf2ACOz8efgpXGK-A6v_Q
request GET https://vk.com/doc801981293_667406864?hash=uZtMvR4ZNW8WKezoz5XxQw5zKDEIBGP5eVquLMZQIhs&dl=LPW7PFXZtcJLownI3eqGgO4ACOVJ8g7SlBJbPXo7NZX&api=1&no_preview=1#WW1
request GET https://sun6-21.userapi.com/c909618/u801981293/docs/d37/81a43648135e/WWW1.bmp?extra=t4h0dCojdHQ9CBRhBgSlMwlX__2pm62d9iqHWHxa4yaqyWbHETFz2CtZPAv8kaHxOrxQorbDrTi3sk1G5eP5MeAcS7R5Es1b2jwTgIL0nLizkKZJ7JW0MBNFmsH1raDTFmJzxnIIH3MnZK-iGw
request GET https://vk.com/doc791620691_663065029?hash=Efubo9FQtw3Bdj42XJVcJwymfIH3PazMKz8g5wJ0dZX&dl=G44TCNRSGA3DSMI:1682787066:QgrgzF33wDt9bwmmOgWCYTv61J7HwhLVZOXGaEdWiKP&api=1&no_preview=1#stats
request GET https://vk.com/doc801981293_667588255?hash=D2CJ0xHL4AttqOVEQrcszbzjAqHflz5sitrNnCDwHML&dl=1MkLYb1Zn2lmLZ7wS6mD5tteEUeivr15Bnn3xZoovqk&api=1&no_preview=1
request GET https://sun6-20.userapi.com/c240331/u801981293/docs/d8/1f5ae35150b7/siddharthabuddh4_2.bmp?extra=B7BtTuv_7jmb8cCMaLam49APjJzrtiYZZzp3rziQku1r1BN59h4GUS5Dlv0sdMxlHC6wmC-J3k578d7Nsnx7pBDX6Oy74RUAIQXIuc0nfUwip49td2R-6P-iXhn7AazYaV5F2sSahyy5VRY36g
request GET https://vk.com/doc801981293_667539838?hash=1wYO1Ous0beVWiHJAejgZ3eSHSzodvDxJWbbkFPgBQs&dl=SQxo7vjhnlb1LQCUeoVijfnKU0E3auPCNV18GmDNZC0&api=1&no_preview=1#test
request GET https://sun6-21.userapi.com/c909418/u801981293/docs/d20/1e2b07ec3a9d/test.bmp?extra=qMq_Hfaqw0yUQD5zYrK1RBqcLLfE3A2AU0FdG85zayvGWJs2ZFqVwwlittGHO2AiyIVbBEjb9ZK5L_1e_9_nKp7YReGxGKr0knhKpVpMJqu_rfIHNIML5L_f8elMCrbXg40EAQk9_-mEr-B2bw
request GET https://vk.com/doc801981293_667486594?hash=imfz8iVrsd0ACccnF0GZIUltD8XX5X3arwn4kxjKrGH&dl=7kNZPXNmlDfZM6XyNQJ0E5zKssx8LEYlz2E1h2FUgZk&api=1&no_preview=1#fse
request GET https://sun6-23.userapi.com/c909228/u801981293/docs/d20/1c1fbf1bf284/fse.bmp?extra=4_jy8uhFMEaLDwCkNxpWmgh94F8cfoFaPIan-8Dtq-90eX9YgxglCma4ibrxupgDp67zjlLLmn3oM4vn_4Lcy60SuF-xbd7WtSmxPbbqXF5I2f8XPvKEFgk5TjKmCaLP5EtabfY2xp2fEb_GZg
request GET https://db-ip.com/
request POST https://api.db-ip.com/v2/p31e4d59ee6ad1a0b5cc80695a873e43a8fbca06/self
request GET https://steamcommunity.com/profiles/76561199532186526
request POST http://94.142.138.131/api/firegate.php
request POST http://aa.imgjeoogbb.com/check/?sid=294936&key=d9eb18658941edfb01ef7f4e4f3bcf60
request POST http://77.91.68.61/rock/index.php
request POST http://65.21.187.146/
request POST http://193.233.254.61/loghub/master
request POST https://api.db-ip.com/v2/p31e4d59ee6ad1a0b5cc80695a873e43a8fbca06/self
ip 176.113.115.84
ip 185.225.73.32
ip 194.26.135.162
ip 209.250.248.11
ip 213.91.128.133
ip 77.91.124.54
ip 95.214.25.207
domain iplis.ru description Russian Federation domain TLD
Time & API Arguments Status Return Repeated

NtProtectVirtualMemory

 process_identifier: 2188
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x74002000
process_handle: 0xffffffff
1 0 0

NtProtectVirtualMemory

 process_identifier: 2188
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x73913000
process_handle: 0xffffffff
1 0 0
domain ipinfo.io
file C:\Users\test22\AppData\Local\Temp\7zEC88D4A16\File.exe
Time & API Arguments Status Return Repeated

LookupPrivilegeValueW

 system_name:
privilege_name: SeRestorePrivilege
1 1 0

LookupPrivilegeValueW

 system_name:
privilege_name: SeSecurityPrivilege
1 1 0
description Escalate priviledges rule Escalate_priviledges
description PWS Memory rule Generic_PWS_Memory_Zero
description (no description) rule DebuggerCheck__GlobalFlags
description (no description) rule DebuggerCheck__QueryInfo
description (no description) rule DebuggerHiding__Thread
description (no description) rule DebuggerHiding__Active
description (no description) rule ThreadControl__Context
description (no description) rule SEH__vectored
description Checks if being debugged rule anti_dbg
description Bypass DEP rule disable_dep
description Run a KeyLogger rule KeyLogger
host 163.123.143.4
host 176.113.115.84
host 176.123.9.142
host 185.225.73.32
host 193.233.254.61
host 194.26.135.162
host 208.67.104.60
host 209.250.248.11
host 45.15.156.229
host 62.122.184.58
host 65.21.187.146
host 77.91.124.231
host 77.91.124.54
host 77.91.68.61
host 85.208.136.10
host 87.121.221.58
host 94.142.138.131
host 95.214.25.207
dead_host 95.214.25.207:80
dead_host 192.168.56.102:49286
dead_host 176.113.115.84:80
dead_host 192.168.56.102:49278
dead_host 192.168.56.102:49289
dead_host 192.168.56.102:49185
dead_host 192.168.56.102:49263
dead_host 176.123.9.142:14845
dead_host 192.168.56.102:49188
dead_host 163.123.143.4:80