Summary | ZeroBOX

Category	Machine	Started	Completed
FILE	s1_win7_x6403_us	Sept. 10, 2023, 9:30 a.m.	Sept. 10, 2023, 9:35 a.m.

Size	277.0KB
Type	PE32+ executable (GUI) x86-64, for MS Windows
MD5	`4fe88bc5440133565a8e28a78d3bbcbd`
SHA256	`e4c38ebe42a935cd3442ec8097bc13913b81179084b6dfc06e1a7ec9a7e4717c`
CRC32	`102183C4`
ssdeep	`6144:2V+4tt25MIRakGNhYPu2p3QS97xNZhF6qv:425MIkkGNwPWixNv`
Yara	Malicious_Library_Zero - Malicious_Library UPX_Zero - UPX packed file PE_Header_Zero - PE File Signature IsPE64 - (no description) ASPack_Zero - ASPack packed file OS_Processor_Check_Zero - OS Processor Check

crypt.exe "C:\Users\test22\AppData\Local\Temp\crypt.exe"
940

Name	Response	Post-Analysis Lookup
aitchain.in	A 185.143.223.51	185.143.223.51

IP Address	Status	Action
164.124.101.2	Active	Moloch

Suricata Alerts

No Suricata Alerts

Suricata TLS

No Suricata TLS

Checks if process is being debugged by a debugger (3 events)

Time & API	Arguments	Status	Return	Repeated
IsDebuggerPresent Sept. 10, 2023, 9:23 a.m.			0	0
IsDebuggerPresent Sept. 10, 2023, 9:23 a.m.			0	0
IsDebuggerPresent Sept. 10, 2023, 9:23 a.m.			0	0

Collects information to fingerprint the system (MachineGuid, DigitalProductId, SystemBiosDate) (1 event)

registry

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\MachineGuid

Checks amount of memory in system, this can be used to detect virtual machines that have a low amount of memory available (1 event)

Time & API	Arguments	Status	Return	Repeated
GlobalMemoryStatusEx Sept. 10, 2023, 9:23 a.m.		1	1	0

The executable contains unknown PE section names indicative of a packer (could be a false positive) (1 event)

section

_RDATA

Allocates read-write-execute memory (usually to unpack itself) (50 out of 84 events)

Time & API	Arguments	Status
NtAllocateVirtualMemory Sept. 10, 2023, 9:23 a.m.	process_identifier: 940 region_size: 589824 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0000000001f30000 allocation_type: 8192 (MEM_RESERVE) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory Sept. 10, 2023, 9:23 a.m.	process_identifier: 940 region_size: 8192 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0000000001f40000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory Sept. 10, 2023, 9:23 a.m.	process_identifier: 940 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fef3641000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory Sept. 10, 2023, 9:23 a.m.	process_identifier: 940 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fef38be000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory Sept. 10, 2023, 9:23 a.m.	process_identifier: 940 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fef38be000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory Sept. 10, 2023, 9:23 a.m.	process_identifier: 940 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fef38bf000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory Sept. 10, 2023, 9:23 a.m.	process_identifier: 940 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fef38bf000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory Sept. 10, 2023, 9:23 a.m.	process_identifier: 940 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fef38bf000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory Sept. 10, 2023, 9:23 a.m.	process_identifier: 940 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fef38bf000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory Sept. 10, 2023, 9:23 a.m.	process_identifier: 940 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fef38bf000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory Sept. 10, 2023, 9:23 a.m.	process_identifier: 940 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fef38bf000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory Sept. 10, 2023, 9:23 a.m.	process_identifier: 940 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fef38bf000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory Sept. 10, 2023, 9:23 a.m.	process_identifier: 940 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fef38bf000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory Sept. 10, 2023, 9:23 a.m.	process_identifier: 940 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fef38c0000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory Sept. 10, 2023, 9:23 a.m.	process_identifier: 940 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fef38c0000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory Sept. 10, 2023, 9:23 a.m.	process_identifier: 940 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fef38c0000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory Sept. 10, 2023, 9:23 a.m.	process_identifier: 940 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fef38c0000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory Sept. 10, 2023, 9:23 a.m.	process_identifier: 940 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fef38c0000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory Sept. 10, 2023, 9:23 a.m.	process_identifier: 940 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fef38c1000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory Sept. 10, 2023, 9:23 a.m.	process_identifier: 940 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fef38c1000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory Sept. 10, 2023, 9:23 a.m.	process_identifier: 940 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fef38c1000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory Sept. 10, 2023, 9:23 a.m.	process_identifier: 940 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fef38c1000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory Sept. 10, 2023, 9:23 a.m.	process_identifier: 940 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fef38be000 process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory Sept. 10, 2023, 9:23 a.m.	process_identifier: 940 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007ff00032000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory Sept. 10, 2023, 9:23 a.m.	process_identifier: 940 region_size: 589824 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fffff20000 allocation_type: 1056768 (MEM_RESERVE\|MEM_TOP_DOWN) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory Sept. 10, 2023, 9:23 a.m.	process_identifier: 940 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fffff20000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory Sept. 10, 2023, 9:23 a.m.	process_identifier: 940 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fffff20000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory Sept. 10, 2023, 9:23 a.m.	process_identifier: 940 region_size: 65536 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fffff10000 allocation_type: 1056768 (MEM_RESERVE\|MEM_TOP_DOWN) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory Sept. 10, 2023, 9:23 a.m.	process_identifier: 940 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fffff10000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory Sept. 10, 2023, 9:23 a.m.	process_identifier: 940 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007ff000ea000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory Sept. 10, 2023, 9:23 a.m.	process_identifier: 940 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007ff00022000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory Sept. 10, 2023, 9:23 a.m.	process_identifier: 940 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fef1dc1000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory Sept. 10, 2023, 9:23 a.m.	process_identifier: 940 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fef245b000 process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory Sept. 10, 2023, 9:23 a.m.	process_identifier: 940 region_size: 917504 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000000001ae70000 allocation_type: 8192 (MEM_RESERVE) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory Sept. 10, 2023, 9:23 a.m.	process_identifier: 940 region_size: 8192 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000000001aed0000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory Sept. 10, 2023, 9:23 a.m.	process_identifier: 940 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fef1dc2000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory Sept. 10, 2023, 9:23 a.m.	process_identifier: 940 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fef1dc2000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory Sept. 10, 2023, 9:23 a.m.	process_identifier: 940 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fef1dc2000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory Sept. 10, 2023, 9:23 a.m.	process_identifier: 940 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fef1dc2000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory Sept. 10, 2023, 9:23 a.m.	process_identifier: 940 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fef1dc2000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory Sept. 10, 2023, 9:23 a.m.	process_identifier: 940 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fef1dc2000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory Sept. 10, 2023, 9:23 a.m.	process_identifier: 940 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fef1dc2000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory Sept. 10, 2023, 9:23 a.m.	process_identifier: 940 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fef1dc2000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory Sept. 10, 2023, 9:23 a.m.	process_identifier: 940 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fef1dc2000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory Sept. 10, 2023, 9:23 a.m.	process_identifier: 940 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fef1dc2000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory Sept. 10, 2023, 9:23 a.m.	process_identifier: 940 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fef1dc2000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory Sept. 10, 2023, 9:23 a.m.	process_identifier: 940 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fef1dc4000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory Sept. 10, 2023, 9:23 a.m.	process_identifier: 940 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fef1dc4000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory Sept. 10, 2023, 9:23 a.m.	process_identifier: 940 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fef1dc4000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory Sept. 10, 2023, 9:23 a.m.	process_identifier: 940 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fef1dc4000 process_handle: 0xffffffffffffffff	1

Checks adapter addresses which can be used to detect virtual network interfaces (1 event)

Time & API	Arguments	Status	Return	Repeated
GetAdaptersAddresses Sept. 10, 2023, 9:23 a.m.	flags: 15 family: 0		111	0

The binary likely contains encrypted or compressed data indicative of a packer (2 events)

section

{u'size_of_data': u'0x00013000', u'virtual_address': u'0x00036000', u'entropy': 7.688921206545019, u'name': u'.rsrc', u'virtual_size': u'0x00012e78'}

entropy

7.68892120655

description

A section with a high entropy has been found

entropy

0.275362318841

description

Overall entropy of this PE file is high

File has been identified by 16 AntiVirus engines on VirusTotal as malicious (16 events)

Bkav	W32.AIDetectMalware.64
FireEye	Generic.mg.4fe88bc544013356
McAfee	Artemis!4FE88BC54401
CrowdStrike	win/malicious_confidence_90% (W)
Symantec	ML.Attribute.HighConfidence
Elastic	malicious (moderate confidence)
Cynet	Malicious (score: 99)
Kaspersky	UDS:DangerousObject.Multi.Generic
F-Secure	Heuristic.HEUR/AGEN.1363347
TrendMicro	TrojanSpy.Win64.REDLINE.YXDIJZ
McAfee-GW-Edition	BehavesLike.Win64.Infected.dh
Avira	HEUR/AGEN.1363347
Gridinsoft	Malware.Win64.RedLine.bot
Microsoft	Trojan:Win32/Synder!ic
ZoneAlarm	UDS:DangerousObject.Multi.Generic
DeepInstinct	MALICIOUS

crypt.exe

Process Tree Toggle all

Network Toggle all

Suricata Toggle all

Suricata Alerts

Suricata TLS

Signatures Toggle All