Summary | ZeroBOX

Category	Machine	Started	Completed
FILE	s1_win7_x6403_us	Sept. 14, 2023, 7:14 p.m.	Sept. 14, 2023, 7:26 p.m.

Size	285.9KB
Type	PE32+ executable (GUI) x86-64, for MS Windows
MD5	`69c0ce8858c37ee1e29fbeb4d0acc928`
SHA256	`58334b23c64f5926faf1201c6875c2b44d60fa9ba85fba7ebc15f1ccabd0f803`
CRC32	`B6E0B97B`
ssdeep	`6144:CV+4tt25MIRakGNhYPu2p3QrhVaTpo5iL:U25MIkkGNwPWr7a2y`
Yara	UPX_Zero - UPX packed file Malicious_Library_Zero - Malicious_Library PE_Header_Zero - PE File Signature IsPE64 - (no description) ASPack_Zero - ASPack packed file OS_Processor_Check_Zero - OS Processor Check

newlife.exe "C:\Users\test22\AppData\Local\Temp\newlife.exe"
884

Name	Response	Post-Analysis Lookup
scamalert.finance	A 89.23.103.10	89.23.103.10

IP Address	Status	Action
156.236.72.121	Active	Moloch
185.225.74.51	Active	Moloch
164.124.101.2	Active	Moloch
87.240.129.133	Active	Moloch
87.240.137.140	Active	Moloch
94.156.35.76	Active	Moloch

Suricata Alerts

No Suricata Alerts

Suricata TLS

No Suricata TLS

Checks if process is being debugged by a debugger (3 events)

Time & API	Arguments	Status	Return	Repeated
IsDebuggerPresent Sept. 14, 2023, 7:14 p.m.			0	0
IsDebuggerPresent Sept. 14, 2023, 7:14 p.m.			0	0
IsDebuggerPresent Sept. 14, 2023, 7:14 p.m.			0	0

Collects information to fingerprint the system (MachineGuid, DigitalProductId, SystemBiosDate) (1 event)

registry

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\MachineGuid

Checks amount of memory in system, this can be used to detect virtual machines that have a low amount of memory available (1 event)

Time & API	Arguments	Status	Return	Repeated
GlobalMemoryStatusEx Sept. 14, 2023, 7:14 p.m.		1	1	0

The executable contains unknown PE section names indicative of a packer (could be a false positive) (1 event)

section

_RDATA

Allocates read-write-execute memory (usually to unpack itself) (50 out of 84 events)

Time & API	Arguments	Status
NtAllocateVirtualMemory Sept. 14, 2023, 7:14 p.m.	process_identifier: 884 region_size: 1114112 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0000000001fd0000 allocation_type: 8192 (MEM_RESERVE) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory Sept. 14, 2023, 7:14 p.m.	process_identifier: 884 region_size: 8192 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0000000002060000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory Sept. 14, 2023, 7:14 p.m.	process_identifier: 884 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fef3641000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory Sept. 14, 2023, 7:14 p.m.	process_identifier: 884 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fef38be000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory Sept. 14, 2023, 7:14 p.m.	process_identifier: 884 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fef38be000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory Sept. 14, 2023, 7:14 p.m.	process_identifier: 884 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fef38bf000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory Sept. 14, 2023, 7:14 p.m.	process_identifier: 884 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fef38bf000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory Sept. 14, 2023, 7:14 p.m.	process_identifier: 884 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fef38bf000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory Sept. 14, 2023, 7:14 p.m.	process_identifier: 884 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fef38bf000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory Sept. 14, 2023, 7:14 p.m.	process_identifier: 884 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fef38bf000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory Sept. 14, 2023, 7:14 p.m.	process_identifier: 884 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fef38bf000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory Sept. 14, 2023, 7:14 p.m.	process_identifier: 884 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fef38bf000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory Sept. 14, 2023, 7:14 p.m.	process_identifier: 884 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fef38bf000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory Sept. 14, 2023, 7:14 p.m.	process_identifier: 884 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fef38c0000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory Sept. 14, 2023, 7:14 p.m.	process_identifier: 884 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fef38c0000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory Sept. 14, 2023, 7:14 p.m.	process_identifier: 884 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fef38c0000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory Sept. 14, 2023, 7:14 p.m.	process_identifier: 884 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fef38c0000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory Sept. 14, 2023, 7:14 p.m.	process_identifier: 884 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fef38c0000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory Sept. 14, 2023, 7:14 p.m.	process_identifier: 884 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fef38c1000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory Sept. 14, 2023, 7:14 p.m.	process_identifier: 884 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fef38c1000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory Sept. 14, 2023, 7:14 p.m.	process_identifier: 884 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fef38c1000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory Sept. 14, 2023, 7:14 p.m.	process_identifier: 884 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fef38c1000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory Sept. 14, 2023, 7:14 p.m.	process_identifier: 884 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fef38be000 process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory Sept. 14, 2023, 7:14 p.m.	process_identifier: 884 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007ff00052000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory Sept. 14, 2023, 7:14 p.m.	process_identifier: 884 region_size: 589824 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fffff20000 allocation_type: 1056768 (MEM_RESERVE\|MEM_TOP_DOWN) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory Sept. 14, 2023, 7:14 p.m.	process_identifier: 884 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fffff20000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory Sept. 14, 2023, 7:14 p.m.	process_identifier: 884 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fffff20000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory Sept. 14, 2023, 7:14 p.m.	process_identifier: 884 region_size: 65536 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fffff10000 allocation_type: 1056768 (MEM_RESERVE\|MEM_TOP_DOWN) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory Sept. 14, 2023, 7:14 p.m.	process_identifier: 884 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fffff10000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory Sept. 14, 2023, 7:14 p.m.	process_identifier: 884 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007ff0010a000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory Sept. 14, 2023, 7:14 p.m.	process_identifier: 884 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007ff00042000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory Sept. 14, 2023, 7:14 p.m.	process_identifier: 884 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fef1dc1000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory Sept. 14, 2023, 7:14 p.m.	process_identifier: 884 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fef245b000 process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory Sept. 14, 2023, 7:14 p.m.	process_identifier: 884 region_size: 589824 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0000000002310000 allocation_type: 8192 (MEM_RESERVE) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory Sept. 14, 2023, 7:14 p.m.	process_identifier: 884 region_size: 8192 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0000000002320000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory Sept. 14, 2023, 7:14 p.m.	process_identifier: 884 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fef1dc2000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory Sept. 14, 2023, 7:14 p.m.	process_identifier: 884 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fef1dc2000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory Sept. 14, 2023, 7:14 p.m.	process_identifier: 884 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fef1dc2000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory Sept. 14, 2023, 7:14 p.m.	process_identifier: 884 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fef1dc2000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory Sept. 14, 2023, 7:14 p.m.	process_identifier: 884 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fef1dc2000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory Sept. 14, 2023, 7:14 p.m.	process_identifier: 884 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fef1dc2000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory Sept. 14, 2023, 7:14 p.m.	process_identifier: 884 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fef1dc2000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory Sept. 14, 2023, 7:14 p.m.	process_identifier: 884 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fef1dc2000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory Sept. 14, 2023, 7:14 p.m.	process_identifier: 884 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fef1dc2000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory Sept. 14, 2023, 7:14 p.m.	process_identifier: 884 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fef1dc2000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory Sept. 14, 2023, 7:14 p.m.	process_identifier: 884 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fef1dc2000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory Sept. 14, 2023, 7:14 p.m.	process_identifier: 884 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fef1dc4000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory Sept. 14, 2023, 7:14 p.m.	process_identifier: 884 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fef1dc4000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory Sept. 14, 2023, 7:14 p.m.	process_identifier: 884 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fef1dc4000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory Sept. 14, 2023, 7:14 p.m.	process_identifier: 884 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fef1dc4000 process_handle: 0xffffffffffffffff	1

Checks adapter addresses which can be used to detect virtual network interfaces (1 event)

Time & API	Arguments	Status	Return	Repeated
GetAdaptersAddresses Sept. 14, 2023, 7:14 p.m.	flags: 15 family: 0		111	0

The binary likely contains encrypted or compressed data indicative of a packer (2 events)

section

{u'size_of_data': u'0x00013800', u'virtual_address': u'0x00036000', u'entropy': 7.754789491365588, u'name': u'.rsrc', u'virtual_size': u'0x00013678'}

entropy

7.75478949137

description

A section with a high entropy has been found

entropy

0.280575539568

description

Overall entropy of this PE file is high

Communicates with host for which no DNS query was performed (5 events)

host	156.236.72.121
host	185.225.74.51
host	87.240.129.133
host	87.240.137.140
host	94.156.35.76

File has been identified by 24 AntiVirus engines on VirusTotal as malicious (24 events)

Bkav	W32.AIDetectMalware.64
Elastic	malicious (high confidence)
McAfee	Artemis!69C0CE8858C3
Cylance	unsafe
Sangfor	Trojan.Win64.Agent.Vu85
VirIT	Trojan.Win64.Agent.BIZ
Symantec	ML.Attribute.HighConfidence
ESET-NOD32	a variant of Win64/Agent.CVR
Kaspersky	UDS:DangerousObject.Multi.Generic
Avast	Win64:PWSX-gen [Trj]
Tencent	Malware.Win32.Gencirc.11b65085
McAfee-GW-Edition	Artemis!Trojan
Sophos	Mal/Generic-S
Ikarus	Win32.Outbreak
Antiy-AVL	Trojan[PSW]/Win32.Stealer
Microsoft	PWS:Win64/Vigorf.A
ZoneAlarm	UDS:DangerousObject.Multi.Generic
AhnLab-V3	Downloader/Win.RedLine.C5486377
Malwarebytes	Malware.AI.4265441246
Panda	Trj/Chgt.AD
Rising	Backdoor.Agent!8.C5D (TFE:5:X1sJOVJibMU)
AVG	Win64:PWSX-gen [Trj]
DeepInstinct	MALICIOUS
CrowdStrike	win/malicious_confidence_70% (W)

Connects to an IP address that is no longer responding to requests (legitimate services will remain up-and-running usually) (1 event)

dead_host

192.168.56.103:49308

newlife.exe

Process Tree Toggle all

Network Toggle all

Suricata Toggle all

Suricata Alerts

Suricata TLS

Signatures Toggle All