Summary | ZeroBOX

Category	Machine	Started	Completed
FILE	s1_win7_x6403_us	Sept. 12, 2023, 9:12 a.m.	Sept. 12, 2023, 9:15 a.m.

Size	282.4KB
Type	PE32+ executable (GUI) x86-64, for MS Windows
MD5	`41bdf3bbb8d27902f5f22e9b5a88a25b`
SHA256	`e2622b67c87d3e730dbd1312d1160faac1ef9bd98f00041e15c00f347d47a949`
CRC32	`1CC963A8`
ssdeep	`6144:8V+4tt25MIRakGNhYPu2p3QZn1igT+fY6s7:y25MIkkGNwPWZ1VqAN7`
Yara	Malicious_Library_Zero - Malicious_Library UPX_Zero - UPX packed file PE_Header_Zero - PE File Signature IsPE64 - (no description) ASPack_Zero - ASPack packed file OS_Processor_Check_Zero - OS Processor Check

cryptnobaa.exe "C:\Users\test22\AppData\Local\Temp\cryptnobaa.exe"
1984

Name	Response	Post-Analysis Lookup
aitchain.in	A 185.143.223.51	185.143.223.51

IP Address	Status	Action
164.124.101.2	Active	Moloch

Suricata Alerts

No Suricata Alerts

Suricata TLS

No Suricata TLS

Checks if process is being debugged by a debugger (3 events)

Time & API	Arguments	Status	Return	Repeated
IsDebuggerPresent Sept. 12, 2023, 9:04 a.m.			0	0
IsDebuggerPresent Sept. 12, 2023, 9:04 a.m.			0	0
IsDebuggerPresent Sept. 12, 2023, 9:04 a.m.			0	0

Collects information to fingerprint the system (MachineGuid, DigitalProductId, SystemBiosDate) (1 event)

registry

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\MachineGuid

Checks amount of memory in system, this can be used to detect virtual machines that have a low amount of memory available (1 event)

Time & API	Arguments	Status	Return	Repeated
GlobalMemoryStatusEx Sept. 12, 2023, 9:04 a.m.		1	1	0

The executable contains unknown PE section names indicative of a packer (could be a false positive) (1 event)

section

_RDATA

Allocates read-write-execute memory (usually to unpack itself) (50 out of 84 events)

Time & API	Arguments	Status
NtAllocateVirtualMemory Sept. 12, 2023, 9:04 a.m.	process_identifier: 1984 region_size: 2424832 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0000000002100000 allocation_type: 8192 (MEM_RESERVE) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory Sept. 12, 2023, 9:04 a.m.	process_identifier: 1984 region_size: 8192 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00000000022d0000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory Sept. 12, 2023, 9:04 a.m.	process_identifier: 1984 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fef35f1000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory Sept. 12, 2023, 9:04 a.m.	process_identifier: 1984 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fef386e000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory Sept. 12, 2023, 9:04 a.m.	process_identifier: 1984 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fef386e000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory Sept. 12, 2023, 9:04 a.m.	process_identifier: 1984 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fef386f000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory Sept. 12, 2023, 9:04 a.m.	process_identifier: 1984 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fef386f000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory Sept. 12, 2023, 9:04 a.m.	process_identifier: 1984 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fef386f000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory Sept. 12, 2023, 9:04 a.m.	process_identifier: 1984 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fef386f000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory Sept. 12, 2023, 9:04 a.m.	process_identifier: 1984 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fef386f000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory Sept. 12, 2023, 9:04 a.m.	process_identifier: 1984 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fef386f000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory Sept. 12, 2023, 9:04 a.m.	process_identifier: 1984 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fef386f000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory Sept. 12, 2023, 9:04 a.m.	process_identifier: 1984 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fef386f000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory Sept. 12, 2023, 9:04 a.m.	process_identifier: 1984 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fef3870000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory Sept. 12, 2023, 9:04 a.m.	process_identifier: 1984 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fef3870000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory Sept. 12, 2023, 9:04 a.m.	process_identifier: 1984 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fef3870000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory Sept. 12, 2023, 9:04 a.m.	process_identifier: 1984 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fef3870000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory Sept. 12, 2023, 9:04 a.m.	process_identifier: 1984 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fef3870000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory Sept. 12, 2023, 9:04 a.m.	process_identifier: 1984 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fef3871000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory Sept. 12, 2023, 9:04 a.m.	process_identifier: 1984 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fef3871000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory Sept. 12, 2023, 9:04 a.m.	process_identifier: 1984 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fef3871000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory Sept. 12, 2023, 9:04 a.m.	process_identifier: 1984 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fef3871000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory Sept. 12, 2023, 9:04 a.m.	process_identifier: 1984 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fef386e000 process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory Sept. 12, 2023, 9:04 a.m.	process_identifier: 1984 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007ff00032000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory Sept. 12, 2023, 9:04 a.m.	process_identifier: 1984 region_size: 589824 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fffff20000 allocation_type: 1056768 (MEM_RESERVE\|MEM_TOP_DOWN) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory Sept. 12, 2023, 9:04 a.m.	process_identifier: 1984 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fffff20000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory Sept. 12, 2023, 9:04 a.m.	process_identifier: 1984 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fffff20000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory Sept. 12, 2023, 9:04 a.m.	process_identifier: 1984 region_size: 65536 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fffff10000 allocation_type: 1056768 (MEM_RESERVE\|MEM_TOP_DOWN) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory Sept. 12, 2023, 9:04 a.m.	process_identifier: 1984 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fffff10000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory Sept. 12, 2023, 9:04 a.m.	process_identifier: 1984 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007ff000ea000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory Sept. 12, 2023, 9:04 a.m.	process_identifier: 1984 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007ff00022000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory Sept. 12, 2023, 9:04 a.m.	process_identifier: 1984 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fef1d71000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory Sept. 12, 2023, 9:04 a.m.	process_identifier: 1984 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fef240b000 process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory Sept. 12, 2023, 9:04 a.m.	process_identifier: 1984 region_size: 2424832 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000000001b4c0000 allocation_type: 8192 (MEM_RESERVE) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory Sept. 12, 2023, 9:04 a.m.	process_identifier: 1984 region_size: 8192 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000000001b690000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory Sept. 12, 2023, 9:04 a.m.	process_identifier: 1984 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fef1d72000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory Sept. 12, 2023, 9:04 a.m.	process_identifier: 1984 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fef1d72000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory Sept. 12, 2023, 9:04 a.m.	process_identifier: 1984 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fef1d72000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory Sept. 12, 2023, 9:04 a.m.	process_identifier: 1984 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fef1d72000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory Sept. 12, 2023, 9:04 a.m.	process_identifier: 1984 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fef1d72000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory Sept. 12, 2023, 9:04 a.m.	process_identifier: 1984 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fef1d72000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory Sept. 12, 2023, 9:04 a.m.	process_identifier: 1984 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fef1d72000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory Sept. 12, 2023, 9:04 a.m.	process_identifier: 1984 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fef1d72000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory Sept. 12, 2023, 9:04 a.m.	process_identifier: 1984 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fef1d72000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory Sept. 12, 2023, 9:04 a.m.	process_identifier: 1984 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fef1d72000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory Sept. 12, 2023, 9:04 a.m.	process_identifier: 1984 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fef1d72000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory Sept. 12, 2023, 9:04 a.m.	process_identifier: 1984 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fef1d74000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory Sept. 12, 2023, 9:04 a.m.	process_identifier: 1984 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fef1d74000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory Sept. 12, 2023, 9:04 a.m.	process_identifier: 1984 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fef1d74000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory Sept. 12, 2023, 9:04 a.m.	process_identifier: 1984 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fef1d74000 process_handle: 0xffffffffffffffff	1

Checks adapter addresses which can be used to detect virtual network interfaces (1 event)

Time & API	Arguments	Status	Return	Repeated
GetAdaptersAddresses Sept. 12, 2023, 9:05 a.m.	flags: 15 family: 0		111	0

The binary likely contains encrypted or compressed data indicative of a packer (2 events)

section

{u'size_of_data': u'0x00012a00', u'virtual_address': u'0x00036000', u'entropy': 7.681854398635697, u'name': u'.rsrc', u'virtual_size': u'0x00012878'}

entropy

7.68185439864

description

A section with a high entropy has been found

entropy

0.271402550091

description

Overall entropy of this PE file is high

File has been identified by 12 AntiVirus engines on VirusTotal as malicious (12 events)

Bkav	W32.AIDetectMalware.64
Elastic	malicious (high confidence)
VirIT	Trojan.Win64.Agent.BIZ
ESET-NOD32	a variant of Win64/Agent.CVR
Avast	Win64:PWSX-gen [Trj]
McAfee-GW-Edition	Artemis!Trojan
Microsoft	Trojan:Win32/Sabsik.FL.B!ml
McAfee	Artemis!41BDF3BBB8D2
Rising	Backdoor.Agent!8.C5D (TFE:5:X1sJOVJibMU)
AVG	Win64:PWSX-gen [Trj]
DeepInstinct	MALICIOUS
CrowdStrike	win/malicious_confidence_70% (W)

cryptnobaa.exe

Process Tree Toggle all

Network Toggle all

Suricata Toggle all

Suricata Alerts

Suricata TLS

Signatures Toggle All