Summary | ZeroBOX

Category	Machine	Started	Completed
FILE	s1_win7_x6401	Aug. 25, 2023, 6:14 p.m.	Aug. 25, 2023, 6:20 p.m.

Size	173.5KB
Type	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
MD5	`c573e900611f78a87d128236180d56db`
SHA256	`648d1707c269dd6067524d0de5cf82e39b5141fb0556738aa13b31c2402b79cd`
CRC32	`ACE080EF`
ssdeep	`1536:Ye8AY1c9wqvnAv77vvvvv7vvvvvvv7vvvvv64+mhhhm+DtqOgk:YeE+9wqY+mhhhmitqOD`
PDB Path	NMK9938.pdb
Yara	PE_Header_Zero - PE File Signature Is_DotNET_EXE - (no description) ConfuserEx_Zero - Confuser .NET IsPE32 - (no description)

NMK9938.exe "C:\Users\test22\AppData\Local\Temp\NMK9938.exe"
2544

Name	Response	Post-Analysis Lookup
No hosts contacted.

IP Address	Status	Action
84.54.50.31	Active	Moloch

Suricata Alerts

No Suricata Alerts

Suricata TLS

No Suricata TLS

Queries for the computername (2 events)

Time & API	Arguments	Status	Return	Repeated
GetComputerNameA Aug. 25, 2023, 6:14 p.m.	computer_name: TEST22-PC	1	1	0
GetComputerNameW Aug. 25, 2023, 6:14 p.m.	computer_name: TEST22-PC	1	1	0

Checks if process is being debugged by a debugger (4 events)

Time & API	Arguments	Status	Return	Repeated
IsDebuggerPresent Aug. 25, 2023, 6:14 p.m.			0	0
IsDebuggerPresent Aug. 25, 2023, 6:14 p.m.			0	0
IsDebuggerPresent Aug. 25, 2023, 6:14 p.m.			0	0
IsDebuggerPresent Aug. 25, 2023, 6:14 p.m.			0	0

This executable has a PDB path (1 event)

pdb_path

NMK9938.pdb

Checks amount of memory in system, this can be used to detect virtual machines that have a low amount of memory available (1 event)

Time & API	Arguments	Status	Return	Repeated
GlobalMemoryStatusEx Aug. 25, 2023, 6:14 p.m.		1	1	0

The executable contains unknown PE section names indicative of a packer (could be a false positive) (2 events)

section	\x02X< f-\x0f>
section

Allocates read-write-execute memory (usually to unpack itself) (17 events)

Time & API	Arguments	Status
NtAllocateVirtualMemory Aug. 25, 2023, 6:14 p.m.	process_identifier: 2544 region_size: 1245184 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00710000 allocation_type: 8192 (MEM_RESERVE) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Aug. 25, 2023, 6:14 p.m.	process_identifier: 2544 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00800000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtProtectVirtualMemory Aug. 25, 2023, 6:14 p.m.	process_identifier: 2544 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x727a1000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Aug. 25, 2023, 6:14 p.m.	process_identifier: 2544 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x727a2000 process_handle: 0xffffffff	1
NtAllocateVirtualMemory Aug. 25, 2023, 6:14 p.m.	process_identifier: 2544 region_size: 1900544 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x02190000 allocation_type: 8192 (MEM_RESERVE) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Aug. 25, 2023, 6:14 p.m.	process_identifier: 2544 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x02320000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Aug. 25, 2023, 6:14 p.m.	process_identifier: 2544 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x003e2000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Aug. 25, 2023, 6:14 p.m.	process_identifier: 2544 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x003fc000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Aug. 25, 2023, 6:14 p.m.	process_identifier: 2544 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00600000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Aug. 25, 2023, 6:14 p.m.	process_identifier: 2544 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x003ea000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Aug. 25, 2023, 6:14 p.m.	process_identifier: 2544 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0041b000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Aug. 25, 2023, 6:14 p.m.	process_identifier: 2544 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00417000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtProtectVirtualMemory Aug. 25, 2023, 6:14 p.m.	process_identifier: 2544 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00372000 process_handle: 0xffffffff	1
NtAllocateVirtualMemory Aug. 25, 2023, 6:14 p.m.	process_identifier: 2544 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00415000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Aug. 25, 2023, 6:14 p.m.	process_identifier: 2544 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0040a000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Aug. 25, 2023, 6:14 p.m.	process_identifier: 2544 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00407000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Aug. 25, 2023, 6:14 p.m.	process_identifier: 2544 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00406000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1

Checks adapter addresses which can be used to detect virtual network interfaces (1 event)

Time & API	Arguments	Status	Return	Repeated
GetAdaptersAddresses Aug. 25, 2023, 6:14 p.m.	flags: 15 family: 0		111	0

The binary likely contains encrypted or compressed data indicative of a packer (1 event)

section

{u'size_of_data': u'0x00000200', u'virtual_address': u'0x00002000', u'entropy': 7.625234609629203, u'name': u'\\x02X<\nf-\\x0f>', u'virtual_size': u'0x0000011c'}

entropy

7.62523460963

description

A section with a high entropy has been found

Communicates with host for which no DNS query was performed (1 event)

host

84.54.50.31

Connects to an IP address that is no longer responding to requests (legitimate services will remain up-and-running usually) (1 event)

dead_host

84.54.50.31:80

File has been identified by 48 AntiVirus engines on VirusTotal as malicious (48 events)

Bkav	W32.Common.8528EF99
Lionic	Trojan.Win32.Stealer.12!c
Elastic	malicious (high confidence)
MicroWorld-eScan	Gen:Variant.Marsilia.49350
FireEye	Generic.mg.c573e900611f78a8
ALYac	Gen:Variant.Marsilia.49350
Malwarebytes	Trojan.Downloader.MSIL
Cynet	Malicious (score: 100)
K7AntiVirus	Trojan-Downloader ( 0059e0c01 )
Alibaba	TrojanPSW:MSIL/Stealer.c1b538ae
K7GW	Trojan-Downloader ( 0059e0c01 )
Cybereason	malicious.f60fe3
BitDefenderTheta	Gen:NN.ZemsilF.36350.ku0@a0jMrab
VirIT	Trojan.Win32.GenusT.DPOO
Cyren	W32/MSIL_Agent.GFC.gen!Eldorado
Symantec	ML.Attribute.HighConfidence
ESET-NOD32	a variant of MSIL/TrojanDownloader.Agent.OOD
APEX	Malicious
Kaspersky	HEUR:Trojan-PSW.MSIL.Stealer.gen
BitDefender	Gen:Variant.Marsilia.49350
Avast	Win32:PWSX-gen [Trj]
Tencent	Msil.Trojan-Downloader.Ader.Qgil
Sophos	Mal/Generic-S
F-Secure	Trojan.TR/Dldr.Agent.sfrxl
VIPRE	Gen:Variant.Marsilia.49350
McAfee-GW-Edition	BehavesLike.Win32.Generic.cm
Emsisoft	Gen:Variant.Marsilia.49350 (B)
SentinelOne	Static AI - Malicious PE
Avira	TR/Dldr.Agent.sfrxl
Antiy-AVL	Trojan[PSW]/MSIL.Stealer
Microsoft	Trojan:Script/Phonzy.B!ml
Gridinsoft	Trojan.Heur!.03012281
ZoneAlarm	HEUR:Trojan-PSW.MSIL.Stealer.gen
GData	Gen:Variant.Marsilia.49350
Google	Detected
AhnLab-V3	Trojan/Win.Generic.R519514
McAfee	Artemis!C573E900611F
MAX	malware (ai score=82)
VBA32	TScope.Trojan.MSIL
Cylance	unsafe
TrendMicro-HouseCall	TROJ_GEN.R002H0CHJ23
Rising	Malware.Obfus/MSIL@AI.87 (RDM.MSIL2:xIQNEcjSON/kfuSLF1EfUA)
Ikarus	Trojan-Downloader.MSIL.Agent
MaxSecure	Trojan.Malware.300983.susgen
Fortinet	MSIL/Agent.OOD!tr.dldr
AVG	Win32:PWSX-gen [Trj]
DeepInstinct	MALICIOUS
CrowdStrike	win/malicious_confidence_100% (W)

NMK9938.exe

Process Tree Toggle all

Network Toggle all

Suricata Toggle all

Suricata Alerts

Suricata TLS

Signatures Toggle All