popup
Summary | ZeroBOX
  1. Home
  2. Result
  3. Report
  4. Detail Analysis

TiWorker.exe

NSIS Malicious Library Admin Tool (Sysinternals etc ...) UPX PE File OS Processor Check PE32
  1. Resubmit sample
Category Machine Started Completed
FILE s1_win7_x6401 Sept. 21, 2023, 9:11 a.m. Sept. 21, 2023, 9:13 a.m.
Size 327.6KB
Type PE32 executable (GUI) Intel 80386, for MS Windows, Nullsoft Installer self-extracting archive
MD5 accd49056a71495f54d8d83ac2a3e901
SHA256 eb793e35af4458eb9591d27e4788f34f4d6babcd866879a71b307842bc68fdfb
CRC32 2FF9BED8
ssdeep 6144:/Ya6+H0ub/yBxjqO5lhnZPQUMB8gqATNzelxXtl8CZriV/eSB:/Yo9byBsWxPQUMBgCzelDqCm/eu
Yara
  • Malicious_Library_Zero - Malicious_Library
  • UPX_Zero - UPX packed file
  • PE_Header_Zero - PE File Signature
  • NSIS_Installer - Null Soft Installer
  • IsPE32 - (no description)

Name Response Post-Analysis Lookup
No hosts contacted.
IP Address Status Action
164.124.101.2 Active Moloch

Suricata Alerts

No Suricata Alerts

Suricata TLS

No Suricata TLS

Time & API Arguments Status Return Repeated

GlobalMemoryStatusEx

 1 1 0
section .ndata
Time & API Arguments Status Return Repeated

__exception__

 stacktrace: 
RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x76f49ed2
RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x76f49ea5

exception.symbol:
exception.exception_code: 0xc0000005
exception.address: 0xffd7f150
registers.esp: 5045956
registers.edi: 0
registers.eax: 1968976824
registers.ebp: 5045964
registers.edx: 4292342096
registers.ebx: 2130567168
registers.esi: 0
registers.ecx: 0
1 0 0
Time & API Arguments Status Return Repeated

NtProtectVirtualMemory

 process_identifier: 2632
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x732a2000
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2732
region_size: 8192
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x00430000
allocation_type: 12288 (MEM_COMMIT|MEM_RESERVE)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2732
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x00440000
allocation_type: 12289 (MEM_COMMIT|MEM_RESERVE)
process_handle: 0xffffffff
1 0 0
file C:\Users\test22\AppData\Local\Temp\othrawj.exe
file C:\Users\test22\AppData\Local\Temp\othrawj.exe
file C:\Users\test22\AppData\Local\Temp\othrawj.exe
Process injection Process 2732 called NtSetContextThread to modify thread in remote process 2788
Time & API Arguments Status Return Repeated

NtSetContextThread

 registers.eip: 1995571652
registers.esp: 5046056
registers.edi: 0
registers.eax: 848208
registers.ebp: 0
registers.edx: 0
registers.ebx: 2130567168
registers.esi: 0
registers.ecx: 0
thread_handle: 0x000000c0
process_identifier: 2788
1 0 0
Bkav W32.AIDetectMalware
Elastic malicious (high confidence)
MicroWorld-eScan Gen:Variant.Fragtor.365975
McAfee Artemis!ACCD49056A71
VIPRE Gen:Variant.Fragtor.365975
Sangfor Suspicious.Win32.Save.ins
Arcabit Trojan.Fragtor.D59597
Symantec ML.Attribute.HighConfidence
ESET-NOD32 a variant of Win32/Injector.ETHT
APEX Malicious
Cynet Malicious (score: 100)
Kaspersky UDS:Trojan.Win32.Strab.gen
BitDefender Gen:Variant.Fragtor.365975
Avast FileRepMalware [Trj]
Emsisoft Gen:Variant.Fragtor.365975 (B)
McAfee-GW-Edition BehavesLike.Win32.Downloader.fc
Trapmine malicious.moderate.ml.score
FireEye Generic.mg.accd49056a71495f
Sophos Generic ML PUA (PUA)
SentinelOne Static AI - Suspicious PE
MAX malware (ai score=85)
Microsoft Trojan:Win32/Sabsik.FL.B!ml
ZoneAlarm UDS:Trojan.Win32.Strab.gen
GData Gen:Variant.Fragtor.365975
Google Detected
AhnLab-V3 Malware/Win.Generic.C4960464
BitDefenderTheta Gen:NN.ZexaF.36722.muW@aOh3vefi
ALYac Gen:Variant.Fragtor.365975
VBA32 BScope.Trojan.Injector
Rising Backdoor.DcRat!8.129D9 (TFE:5:Ss54opyoq0S)
Ikarus Trojan.Win32.Injector
Fortinet NSIS/Injector.ETGJ!tr
AVG FileRepMalware [Trj]
DeepInstinct MALICIOUS
CrowdStrike win/malicious_confidence_100% (W)