Summary | ZeroBOX

Category	Machine	Started	Completed
FILE	s1_win7_x6402	Aug. 17, 2023, 9:20 a.m.	Aug. 17, 2023, 9:22 a.m.

Size	274.0KB
Type	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
MD5	`aa9991d405f0742d592ca9a3c193a931`
SHA256	`fcf532d6bfb6e1c5707b341f7a7ef6f7ee09003f6d4314064ab69d89403acc09`
CRC32	`EC8EE0B6`
ssdeep	`6144:MZQUlCQzPuc3QqCjXvvGio1TAXaDuGsFVncn:QjlCO5gnrvroCaDuGs/`
PDB Path	C:\Users\Administrator\Desktop\crypter\payload\target\release\deps\payload.pdb
Yara	OS_Processor_Check_Zero - OS Processor Check UPX_Zero - UPX packed file IsDLL - (no description) IsPE64 - (no description) PE_Header_Zero - PE File Signature Malicious_Packer_Zero - Malicious Packer

rundll32.exe "C:\Windows\System32\rundll32.exe" C:\Users\test22\AppData\Local\Temp\payload.dll,DllRegisterServer
612
- rundll32.exe "C:\Windows\System32\rundll32.exe" C:\Users\test22\AppData\Local\Temp\payload.dll,DllRegisterServer
  1632
rundll32.exe "C:\Windows\System32\rundll32.exe" C:\Users\test22\AppData\Local\Temp\payload.dll,DllUnregisterServer
1184
- rundll32.exe "C:\Windows\System32\rundll32.exe" C:\Users\test22\AppData\Local\Temp\payload.dll,DllUnregisterServer
  1716
rundll32.exe "C:\Windows\System32\rundll32.exe" C:\Users\test22\AppData\Local\Temp\payload.dll,DllGetClassObject
2996
- rundll32.exe "C:\Windows\System32\rundll32.exe" C:\Users\test22\AppData\Local\Temp\payload.dll,DllGetClassObject
  2520
rundll32.exe "C:\Windows\System32\rundll32.exe" C:\Users\test22\AppData\Local\Temp\payload.dll,Run
2384
- rundll32.exe "C:\Windows\System32\rundll32.exe" C:\Users\test22\AppData\Local\Temp\payload.dll,Run
  1680
rundll32.exe "C:\Windows\System32\rundll32.exe" C:\Users\test22\AppData\Local\Temp\payload.dll,
1608

Name	Response	Post-Analysis Lookup
No hosts contacted.

IP Address	Status	Action
164.124.101.2	Active	Moloch

Suricata Alerts

No Suricata Alerts

Suricata TLS

No Suricata TLS

Checks if process is being debugged by a debugger (4 events)

Time & API	Arguments	Status	Return	Repeated
IsDebuggerPresent Aug. 17, 2023, 9:13 a.m.			0	0
IsDebuggerPresent Aug. 17, 2023, 9:13 a.m.			0	0
IsDebuggerPresent Aug. 17, 2023, 9:13 a.m.			0	0
IsDebuggerPresent Aug. 17, 2023, 9:13 a.m.			0	0

This executable has a PDB path (1 event)

pdb_path

C:\Users\Administrator\Desktop\crypter\payload\target\release\deps\payload.pdb

Checks amount of memory in system, this can be used to detect virtual machines that have a low amount of memory available (1 event)

Time & API	Arguments	Status	Return	Repeated
GlobalMemoryStatusEx Aug. 17, 2023, 9:13 a.m.		1	1	0

Allocates read-write-execute memory (usually to unpack itself) (8 events)

Time & API	Arguments	Status
NtProtectVirtualMemory Aug. 17, 2023, 9:13 a.m.	process_identifier: 1632 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fefa1b7000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory Aug. 17, 2023, 9:13 a.m.	process_identifier: 1632 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fef69c9000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory Aug. 17, 2023, 9:13 a.m.	process_identifier: 1716 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fefa1b7000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory Aug. 17, 2023, 9:13 a.m.	process_identifier: 1716 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fef69c9000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory Aug. 17, 2023, 9:13 a.m.	process_identifier: 2520 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fefa1b7000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory Aug. 17, 2023, 9:13 a.m.	process_identifier: 2520 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fef69c9000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory Aug. 17, 2023, 9:13 a.m.	process_identifier: 1680 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fefa1b7000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory Aug. 17, 2023, 9:13 a.m.	process_identifier: 1680 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fef69c9000 process_handle: 0xffffffffffffffff	1

File has been identified by 29 AntiVirus engines on VirusTotal as malicious (29 events)

Bkav	W32.AIDetectMalware.64
Elastic	malicious (high confidence)
MicroWorld-eScan	Gen:Variant.Zusy.477766
FireEye	Gen:Variant.Zusy.477766
Malwarebytes	Malware.AI.4070095331
CrowdStrike	win/malicious_confidence_70% (W)
Arcabit	Trojan.Zusy.D74A46
Cyren	W64/Injector.BOK.gen!Eldorado
ESET-NOD32	a variant of Win64/Injector.MM
Cynet	Malicious (score: 100)
Kaspersky	VHO:Trojan.Win32.Sasfis.gen
BitDefender	Gen:Variant.Zusy.477766
Avast	Win64:InjectorX-gen [Trj]
Tencent	Malware.Win32.Gencirc.11b55a4c
Emsisoft	Gen:Variant.Zusy.477766 (B)
VIPRE	Gen:Variant.Zusy.477766
Jiangmin	Exploit.Donut.d
Antiy-AVL	Trojan/Win64.Injector
ZoneAlarm	VHO:Trojan.Win32.Sasfis.gen
GData	Gen:Variant.Zusy.477766
Google	Detected
AhnLab-V3	Trojan/Win.Generic.R593194
ALYac	Gen:Variant.Zusy.477766
MAX	malware (ai score=82)
Rising	Trojan.Rozena!8.6D (TFE:6:z77mEFJ0OLO)
Ikarus	Trojan.Win64.Injector
Fortinet	W64/Injector.MM!tr
AVG	Win64:InjectorX-gen [Trj]
DeepInstinct	MALICIOUS

payload.dll

Process Tree Toggle all

Network Toggle all

Suricata Toggle all

Suricata Alerts

Suricata TLS

Signatures Toggle All