Summary | ZeroBOX

Category	Machine	Started	Completed
FILE	s1_win7_x6403_us	Aug. 25, 2023, 6:14 p.m.	Aug. 25, 2023, 6:27 p.m.

Size	10.5KB
Type	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
MD5	`d5eb2ad29761398ed7bcaf3648265ea1`
SHA256	`8dee64363a078fefac0ebda6136979e006bebc231ff17a99cc56c352d3dd1951`
CRC32	`129B246B`
ssdeep	`192:Lplv5pHYKNOx42F48E71H/XF7hHbnOOMAc:LnYK6w8E71jbOOMA`
PDB Path	MKInI988.pdb
Yara	PE_Header_Zero - PE File Signature Is_DotNET_EXE - (no description) ConfuserEx_Zero - Confuser .NET IsPE32 - (no description)

2.exe "C:\Users\test22\AppData\Local\Temp\2.exe"
1648

Name	Response	Post-Analysis Lookup
No hosts contacted.

IP Address	Status	Action
84.54.50.31	Active	Moloch
51.15.65.182	Active	Moloch

Suricata Alerts

No Suricata Alerts

Suricata TLS

No Suricata TLS

Queries for the computername (2 events)

Time & API	Arguments	Status	Return	Repeated
GetComputerNameA Aug. 25, 2023, 6:14 p.m.	computer_name: TEST22-PC	1	1	0
GetComputerNameW Aug. 25, 2023, 6:14 p.m.	computer_name: TEST22-PC	1	1	0

Checks if process is being debugged by a debugger (4 events)

Time & API	Arguments	Status	Return	Repeated
IsDebuggerPresent Aug. 25, 2023, 6:14 p.m.			0	0
IsDebuggerPresent Aug. 25, 2023, 6:14 p.m.			0	0
IsDebuggerPresent Aug. 25, 2023, 6:14 p.m.			0	0
IsDebuggerPresent Aug. 25, 2023, 6:14 p.m.			0	0

This executable has a PDB path (1 event)

pdb_path

MKInI988.pdb

Checks amount of memory in system, this can be used to detect virtual machines that have a low amount of memory available (1 event)

Time & API	Arguments	Status	Return	Repeated
GlobalMemoryStatusEx Aug. 25, 2023, 6:14 p.m.		1	1	0

The executable contains unknown PE section names indicative of a packer (could be a false positive) (2 events)

section	*H\x1d}\x06\x03>Q
section

Allocates read-write-execute memory (usually to unpack itself) (17 events)

Time & API	Arguments	Status
NtAllocateVirtualMemory Aug. 25, 2023, 6:14 p.m.	process_identifier: 1648 region_size: 1179648 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00430000 allocation_type: 8192 (MEM_RESERVE) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Aug. 25, 2023, 6:14 p.m.	process_identifier: 1648 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00510000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtProtectVirtualMemory Aug. 25, 2023, 6:14 p.m.	process_identifier: 1648 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x73f61000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Aug. 25, 2023, 6:14 p.m.	process_identifier: 1648 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x73f62000 process_handle: 0xffffffff	1
NtAllocateVirtualMemory Aug. 25, 2023, 6:14 p.m.	process_identifier: 1648 region_size: 2097152 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x02040000 allocation_type: 8192 (MEM_RESERVE) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Aug. 25, 2023, 6:14 p.m.	process_identifier: 1648 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x02200000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Aug. 25, 2023, 6:14 p.m.	process_identifier: 1648 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x003b2000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Aug. 25, 2023, 6:14 p.m.	process_identifier: 1648 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x003cc000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Aug. 25, 2023, 6:14 p.m.	process_identifier: 1648 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00a70000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Aug. 25, 2023, 6:14 p.m.	process_identifier: 1648 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x003ba000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Aug. 25, 2023, 6:14 p.m.	process_identifier: 1648 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x003eb000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Aug. 25, 2023, 6:14 p.m.	process_identifier: 1648 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x003e7000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtProtectVirtualMemory Aug. 25, 2023, 6:14 p.m.	process_identifier: 1648 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00aa2000 process_handle: 0xffffffff	1
NtAllocateVirtualMemory Aug. 25, 2023, 6:14 p.m.	process_identifier: 1648 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x003e5000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Aug. 25, 2023, 6:14 p.m.	process_identifier: 1648 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x003da000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Aug. 25, 2023, 6:14 p.m.	process_identifier: 1648 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x003d7000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Aug. 25, 2023, 6:14 p.m.	process_identifier: 1648 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x003d6000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1

Checks adapter addresses which can be used to detect virtual network interfaces (1 event)

Time & API	Arguments	Status	Return	Repeated
GetAdaptersAddresses Aug. 25, 2023, 6:14 p.m.	flags: 15 family: 0		111	0

The binary likely contains encrypted or compressed data indicative of a packer (1 event)

section

{u'size_of_data': u'0x00000400', u'virtual_address': u'0x00002000', u'entropy': 7.8204457536860685, u'name': u'*H\\x1d}\\x06\\x03>Q', u'virtual_size': u'0x00000250'}

entropy

7.82044575369

description

A section with a high entropy has been found

Communicates with host for which no DNS query was performed (2 events)

host	84.54.50.31
host	51.15.65.182

Connects to an IP address that is no longer responding to requests (legitimate services will remain up-and-running usually) (1 event)

dead_host

84.54.50.31:80

File has been identified by 48 AntiVirus engines on VirusTotal as malicious (48 events)

Bkav	W32.Common.85FB58FB
Lionic	Trojan.Win32.Stealer.12!c
MicroWorld-eScan	Gen:Variant.Tedy.419780
FireEye	Generic.mg.d5eb2ad29761398e
ALYac	Gen:Variant.Tedy.419780
Malwarebytes	Backdoor.AsyncRAT
Zillya	Dropper.Bladabindi.Win32.437
Sangfor	Suspicious.Win32.Save.a
K7AntiVirus	Trojan-Downloader ( 0059e0c01 )
Alibaba	TrojanPSW:MSIL/Stealer.0e604cdf
K7GW	Trojan-Downloader ( 0059e0c01 )
CrowdStrike	win/malicious_confidence_100% (W)
BitDefenderTheta	Gen:NN.ZemsilF.36350.au0@a8WbvUl
Cyren	W32/MSIL_Agent.DGI.gen!Eldorado
Symantec	ML.Attribute.HighConfidence
Elastic	malicious (high confidence)
ESET-NOD32	a variant of MSIL/TrojanDownloader.Agent.OOD
Cynet	Malicious (score: 100)
APEX	Malicious
Kaspersky	HEUR:Trojan-PSW.MSIL.Stealer.gen
BitDefender	Gen:Variant.Tedy.419780
Avast	Win32:RATX-gen [Trj]
Tencent	Malware.Win32.Gencirc.13ecb08a
Emsisoft	Gen:Variant.Tedy.419780 (B)
F-Secure	Trojan.TR/Dldr.Agent.pufhh
VIPRE	Gen:Variant.Tedy.419780
McAfee-GW-Edition	BehavesLike.Win32.Generic.lm
Sophos	Mal/Generic-S
SentinelOne	Static AI - Malicious PE
Avira	TR/Dldr.Agent.pufhh
Antiy-AVL	Trojan[Spy]/MSIL.Noon
Gridinsoft	Trojan.Heur!.03012281
Microsoft	Trojan:Win32/Sabsik.TE.B!ml
ZoneAlarm	HEUR:Trojan-PSW.MSIL.Stealer.gen
GData	Gen:Variant.Tedy.419780
Google	Detected
Acronis	suspicious
McAfee	Artemis!D5EB2AD29761
MAX	malware (ai score=85)
Cylance	unsafe
TrendMicro-HouseCall	TROJ_GEN.R002H0CHJ23
Rising	Stealer.Agent!8.C2 (CLOUD)
Ikarus	Trojan-Downloader.MSIL.Agent
MaxSecure	Trojan.Malware.300983.susgen
Fortinet	MSIL/Agent.OOD!tr.dldr
AVG	Win32:RATX-gen [Trj]
Cybereason	malicious.44b354
DeepInstinct	MALICIOUS

2.exe

Process Tree Toggle all

Network Toggle all

Suricata Toggle all

Suricata Alerts

Suricata TLS

Signatures Toggle All