popup
Summary | ZeroBOX
  1. Home
  2. Result
  3. Report
  4. Detail Analysis

exto.exe

UPX Malicious Library PWS AntiDebug PE File OS Processor Check PE32 AntiVM
  1. Resubmit sample
Category Machine Started Completed
FILE s1_win7_x6401 Sept. 21, 2023, 6:09 p.m. Sept. 21, 2023, 6:14 p.m.
Size 1.0MB
Type PE32 executable (console) Intel 80386, for MS Windows
MD5 27e81eda70881f1875c07fb6a9da8a5e
SHA256 2eeb6e8d825add69f636c037423584f0fdde89fa08b22f0d86401808166058a6
CRC32 AA1C3809
ssdeep 12288:LoWddPenEp953bXeWJOTfo8o+NFJiJRTTw7KuLpJhz2wxns0m7dsfD5:n/PenEp953bQfo8LnAT87R/ns0m7Y
PDB Path C:\256lho\Ghost.pdb
Yara
  • Malicious_Library_Zero - Malicious_Library
  • UPX_Zero - UPX packed file
  • PE_Header_Zero - PE File Signature
  • IsPE32 - (no description)
  • OS_Processor_Check_Zero - OS Processor Check

Name Response Post-Analysis Lookup
No hosts contacted.
IP Address Status Action
5.42.92.211 Active Moloch

Suricata Alerts

Flow SID Signature Category
TCP 192.168.56.101:49165 -> 5.42.92.211:80 2047625 ET MALWARE [ANY.RUN] Win32/Stealc Checkin (POST) A Network Trojan was detected
TCP 192.168.56.101:49165 -> 5.42.92.211:80 2018358 ET HUNTING GENERIC SUSPICIOUS POST to Dotted Quad with Fake Browser 1 Potentially Bad Traffic

Suricata TLS

No Suricata TLS

Time & API Arguments Status Return Repeated

WriteConsoleA

 buffer: Rushing through
console_handle: 0x00000007
1 1 0

WriteConsoleA

 buffer: 5 and 006AB800
console_handle: 0x00000007
1 1 0

WriteConsoleA

 buffer: 5 and 006AB800
console_handle: 0x00000007
1 1 0

WriteConsoleA

 buffer: 3 and 003CFDB0
console_handle: 0x00000007
1 1 0

WriteConsoleA

 buffer: 2 and 003CFDB0
console_handle: 0x00000007
1 1 0

WriteConsoleA

 buffer: 2 and 003CFDB0
console_handle: 0x00000007
1 1 0

WriteConsoleA

 buffer: 4 and 006AB800
console_handle: 0x00000007
1 1 0

WriteConsoleA

 buffer: 4 and 006AB800
console_handle: 0x00000007
1 1 0

WriteConsoleA

 buffer: 9 and 006ACD28
console_handle: 0x00000007
1 1 0

WriteConsoleA

 buffer: 7 and 006AB800
console_handle: 0x00000007
1 1 0

WriteConsoleA

 buffer: 7 and 006AB800
console_handle: 0x00000007
1 1 0

WriteConsoleA

 buffer: 3 and 003CFDB0
console_handle: 0x00000007
1 1 0

WriteConsoleA

 buffer: 6 and 006AB800
console_handle: 0x00000007
1 1 0

WriteConsoleA

 buffer: 7 and 006AB800
console_handle: 0x00000007
1 1 0

WriteConsoleA

 buffer: 6 and 006AB800
console_handle: 0x00000007
1 1 0

WriteConsoleA

 buffer: 6 and 006AB800
console_handle: 0x00000007
1 1 0

WriteConsoleA

 buffer: 4 and 006AB800
console_handle: 0x00000007
1 1 0

WriteConsoleA

 buffer: 3 and 003CFDB0
console_handle: 0x00000007
1 1 0

WriteConsoleA

 buffer: 6 and 006AB800
console_handle: 0x00000007
1 1 0

WriteConsoleA

 buffer: 7 and 006AB800
console_handle: 0x00000007
1 1 0

WriteConsoleA

 buffer: 6 and 006AB800
console_handle: 0x00000007
1 1 0

WriteConsoleA

 buffer: 7 and 006AB800
console_handle: 0x00000007
1 1 0

WriteConsoleA

 buffer: 3 and 003CFDB0
console_handle: 0x00000007
1 1 0

WriteConsoleA

 buffer: 6 and 006AB800
console_handle: 0x00000007
1 1 0

WriteConsoleA

 buffer: 3 and 003CFDB0
console_handle: 0x00000007
1 1 0

WriteConsoleA

 buffer: 2 and 003CFDB0
console_handle: 0x00000007
1 1 0

WriteConsoleA

 buffer: 2 and 003CFDB0
console_handle: 0x00000007
1 1 0

WriteConsoleA

 buffer: 2 and 003CFDB0
console_handle: 0x00000007
1 1 0

WriteConsoleA

 buffer: 5 and 006AB800
console_handle: 0x00000007
1 1 0

WriteConsoleA

 buffer: 6 and 006AB800
console_handle: 0x00000007
1 1 0

WriteConsoleA

 buffer: 3 and 003CFDB0
console_handle: 0x00000007
1 1 0

WriteConsoleA

 buffer: 8 and 006ACD28
console_handle: 0x00000007
1 1 0

WriteConsoleA

 buffer: 5 and 006AB800
console_handle: 0x00000007
1 1 0

WriteConsoleA

 buffer: 5 and 006AB800
console_handle: 0x00000007
1 1 0

WriteConsoleA

 buffer: 5 and 006AB800
console_handle: 0x00000007
1 1 0

WriteConsoleA

 buffer: 6 and 006AB800
console_handle: 0x00000007
1 1 0

WriteConsoleA

 buffer: 4 and 006AB800
console_handle: 0x00000007
1 1 0

WriteConsoleA

 buffer: 6 and 006AB800
console_handle: 0x00000007
1 1 0

WriteConsoleA

 buffer: 6 and 006AB800
console_handle: 0x00000007
1 1 0

WriteConsoleA

 buffer: 7 and 006AB800
console_handle: 0x00000007
1 1 0

WriteConsoleA

 buffer: 9 and 006ACD28
console_handle: 0x00000007
1 1 0

WriteConsoleA

 buffer: 4 and 006AB800
console_handle: 0x00000007
1 1 0

WriteConsoleA

 buffer: 4 and 006AB800
console_handle: 0x00000007
1 1 0

WriteConsoleA

 buffer: 4 and 006AB800
console_handle: 0x00000007
1 1 0

WriteConsoleA

 buffer: 6 and 006AB800
console_handle: 0x00000007
1 1 0

WriteConsoleA

 buffer: 5 and 006AB800
console_handle: 0x00000007
1 1 0

WriteConsoleA

 buffer: 9 and 006ACD28
console_handle: 0x00000007
1 1 0

WriteConsoleA

 buffer: b and 006ACD28
console_handle: 0x00000007
1 1 0

WriteConsoleA

 buffer: 9 and 006ACD28
console_handle: 0x00000007
1 1 0

WriteConsoleA

 buffer: 4 and 006AB800
console_handle: 0x00000007
1 1 0
pdb_path C:\256lho\Ghost.pdb
section .KZP
section .00cfg
packer Microsoft Visual C++ V8.0 (Debug)
suspicious_features POST method with no referer header, Connection to IP address suspicious_request POST http://5.42.92.211/loghub/master
request POST http://5.42.92.211/loghub/master
request POST http://5.42.92.211/loghub/master
Time & API Arguments Status Return Repeated

NtProtectVirtualMemory

 process_identifier: 2692
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x75d41000
process_handle: 0xffffffff
1 0 0

NtProtectVirtualMemory

 process_identifier: 2692
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x75e61000
process_handle: 0xffffffff
1 0 0

NtProtectVirtualMemory

 process_identifier: 2692
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x76161000
process_handle: 0xffffffff
1 0 0
description PWS Memory rule Generic_PWS_Memory_Zero
description (no description) rule DebuggerCheck__GlobalFlags
description (no description) rule DebuggerCheck__QueryInfo
description (no description) rule DebuggerHiding__Thread
description (no description) rule DebuggerHiding__Active
description (no description) rule ThreadControl__Context
description (no description) rule SEH__vectored
description Checks if being debugged rule anti_dbg
description Bypass DEP rule disable_dep
host 5.42.92.211
Time & API Arguments Status Return Repeated

NtAllocateVirtualMemory

 process_identifier: 2692
region_size: 192512
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x00400000
allocation_type: 12288 (MEM_COMMIT|MEM_RESERVE)
process_handle: 0x0000002c
1 0 0
Time & API Arguments Status Return Repeated

WriteProcessMemory

 buffer: MZÿÿ¸@º´ Í!¸LÍ!This program cannot be run in DOS mode. $àž ¤ÿmY¤ÿmY¤ÿmYwnX¨ÿmYwhX2ÿmYwiX°ÿmYY¦ÿmYhX‚ÿmYiXµÿmYnX°ÿmYwlX§ÿmY¤ÿlYðÿmY°€dX´ÿmY°€’Y¥ÿmY°€oX¥ÿmYRich¤ÿmYPEL„£ eà $ú¸A@ð@Œu(°àÀp' k`j@.textÐùú `.rdata¸klþ@@.dataø!€ j@À.rsrcà°v@@.relocp'À(x@B
base_address: 0x00400000
process_identifier: 2692
process_handle: 0x0000002c
1 1 0

WriteProcessMemory

 buffer: ÿÿÿÿ±¿DNæ@»ÿÿÿÿ “ ÿÿÿÿ abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ¤`‚y‚!¦ß¡¥Ÿàü@~€ü¨Á£Ú£ þ@þµÁ£Ú£ þAþ¶Ï¢ä¢å¢è¢[þ@~¡þQQÚ^Ú _ÚjÚ2ÓØÞàù1~þˆ*B@†B@†B@†B@†B@†BH†B-Bˆ.BÈ$B€…B`€BC˜†BؕBؕBؕBؕBؕBؕBؕBؕBؕBœ†BܕBܕBܕBܕBܕBܕBܕB..þÿÿÿ   þÿÿÿu˜ãŸÍЭsÓÒgßȧeŠŸ¯/&r'l…n ^­zTÚvy÷5ÿÿÿÿgƒƒÝ ’jËã)EÎYw¹)ù”ÚœÕ_¯¢•Ì½EÒW¿þ|/žÞZƼ J¦ãÔØU*ÙøDØàÿˆÓ{Ž«3z¹ÐëHV˜³FEDîCþ :‰ç˵Tl%ÚòÞäêþè"~'Êìþ‚!Œ@1i@óÓx[ŸpxfÚ¶CÏOˆ_§Ö‡£BÛKíí6ÐՆsôÎÿ@tQŒðòS\Á…kŸÈtÁA!¤ð·=ñÄ}/ìvHâ`˜Qÿà,ÂÅXtVXÙSYÊpâé̈„®ú`wt0B‰YåÆæ ±îbmSs’/ñÕÜÂ/9{êÃ[&AÍréªíð¡Öx»nzˆN—e±Ag8¿n=ëºn_]W;éÆ î¹ýèÀTk1áVϤÍH—BÙØg5C´÷1æž"ÉÍÙèÌøA²ãép·|wðïÀ¢cSa&Ù¤ÏVvv@²¸^Š=£¡˜Æà#°ðrÆN, H¦³¬1¾Gò ¤8Qmη˜t̽!OKP`¡É»R½òÕ;“ØÕá _["Šx HÃ,tª¹‡kHy îÞ?øÿ¥ë5ÆááQÿt¡žx0y¡mu“jRžÙŽn]àÆK’¬0"ÀÄí>ßH<~ɽ:yʉ‰Š)d¼Nz”ÆPûÁ×o baJ.|º<…dh©8þçå_–…qRé íß¿iË®üäù´(“dC>n8y¶˜wx«|^B.?AVbad_exception@std@@|^B.?AVexception@std@@|^B.?AVtype_info@@
base_address: 0x00428000
process_identifier: 2692
process_handle: 0x0000002c
1 1 0

WriteProcessMemory

 buffer: €0€ H`°}<?xml version='1.0' encoding='UTF-8' standalone='yes'?> <assembly xmlns='urn:schemas-microsoft-com:asm.v1' manifestVersion='1.0'> <trustInfo xmlns="urn:schemas-microsoft-com:asm.v3"> <security> <requestedPrivileges> <requestedExecutionLevel level='asInvoker' uiAccess='false' /> </requestedPrivileges> </security> </trustInfo> </assembly>
base_address: 0x0042b000
process_identifier: 2692
process_handle: 0x0000002c
1 1 0

WriteProcessMemory

 buffer: @
base_address: 0xfffde008
process_identifier: 2692
process_handle: 0x0000002c
1 1 0
Time & API Arguments Status Return Repeated

WriteProcessMemory

 buffer: MZÿÿ¸@º´ Í!¸LÍ!This program cannot be run in DOS mode. $àž ¤ÿmY¤ÿmY¤ÿmYwnX¨ÿmYwhX2ÿmYwiX°ÿmYY¦ÿmYhX‚ÿmYiXµÿmYnX°ÿmYwlX§ÿmY¤ÿlYðÿmY°€dX´ÿmY°€’Y¥ÿmY°€oX¥ÿmYRich¤ÿmYPEL„£ eà $ú¸A@ð@Œu(°àÀp' k`j@.textÐùú `.rdata¸klþ@@.dataø!€ j@À.rsrcà°v@@.relocp'À(x@B
base_address: 0x00400000
process_identifier: 2692
process_handle: 0x0000002c
1 1 0
Process injection Process 2572 called NtSetContextThread to modify thread in remote process 2692
Time & API Arguments Status Return Repeated

NtSetContextThread

 registers.eip: 1995571652
registers.esp: 3014260
registers.edi: 0
registers.eax: 4198977
registers.ebp: 0
registers.edx: 0
registers.ebx: -139264
registers.esi: 0
registers.ecx: 0
thread_handle: 0x00000020
process_identifier: 2692
1 0 0
Process injection Process 2572 resumed a thread in remote process 2692
Time & API Arguments Status Return Repeated

NtResumeThread

 thread_handle: 0x00000020
suspend_count: 1
process_identifier: 2692
1 0 0
Bkav W32.AIDetectMalware
Cyren W32/Kryptik.KRU.gen!Eldorado
Symantec ML.Attribute.HighConfidence
Elastic malicious (high confidence)
ESET-NOD32 a variant of Win32/GenKryptik.GOBL
Cynet Malicious (score: 100)
Kaspersky HEUR:Trojan-PSW.Win32.Stealerc.gen
Avast PWSX-gen [Trj]
DrWeb Trojan.Inject4.61247
Ikarus Trojan.Win32.Injector
Webroot W32.Trojan.Gen
Antiy-AVL Trojan/Win32.Sabsik
Microsoft Trojan:Win32/Sabsik.FL.B!ml
ZoneAlarm HEUR:Trojan-PSW.Win32.Stealerc.gen
Google Detected
VBA32 BScope.Trojan.Wacatac
Panda Trj/Genetic.gen
Rising Stealer.Stealerc!8.17BE0 (TFE:1:2IOPZNDHrYF)
Fortinet W32/Kryptik.HURI!tr
AVG PWSX-gen [Trj]
DeepInstinct MALICIOUS
Time & API Arguments Status Return Repeated

CreateProcessInternalW

 thread_identifier: 2696
thread_handle: 0x00000020
process_identifier: 2692
current_directory:
filepath: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
track: 1
command_line:
filepath_r: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
stack_pivoted: 0
creation_flags: 4 (CREATE_SUSPENDED)
inherit_handles: 0
process_handle: 0x0000002c
1 1 0

NtGetContextThread

 thread_handle: 0x00000020
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2692
region_size: 192512
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x00400000
allocation_type: 12288 (MEM_COMMIT|MEM_RESERVE)
process_handle: 0x0000002c
1 0 0

WriteProcessMemory

 buffer: MZÿÿ¸@º´ Í!¸LÍ!This program cannot be run in DOS mode. $àž ¤ÿmY¤ÿmY¤ÿmYwnX¨ÿmYwhX2ÿmYwiX°ÿmYY¦ÿmYhX‚ÿmYiXµÿmYnX°ÿmYwlX§ÿmY¤ÿlYðÿmY°€dX´ÿmY°€’Y¥ÿmY°€oX¥ÿmYRich¤ÿmYPEL„£ eà $ú¸A@ð@Œu(°àÀp' k`j@.textÐùú `.rdata¸klþ@@.dataø!€ j@À.rsrcà°v@@.relocp'À(x@B
base_address: 0x00400000
process_identifier: 2692
process_handle: 0x0000002c
1 1 0

WriteProcessMemory

 buffer:
base_address: 0x00401000
process_identifier: 2692
process_handle: 0x0000002c
1 1 0

WriteProcessMemory

 buffer:
base_address: 0x00421000
process_identifier: 2692
process_handle: 0x0000002c
1 1 0

WriteProcessMemory

 buffer: ÿÿÿÿ±¿DNæ@»ÿÿÿÿ “ ÿÿÿÿ abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ¤`‚y‚!¦ß¡¥Ÿàü@~€ü¨Á£Ú£ þ@þµÁ£Ú£ þAþ¶Ï¢ä¢å¢è¢[þ@~¡þQQÚ^Ú _ÚjÚ2ÓØÞàù1~þˆ*B@†B@†B@†B@†B@†BH†B-Bˆ.BÈ$B€…B`€BC˜†BؕBؕBؕBؕBؕBؕBؕBؕBؕBœ†BܕBܕBܕBܕBܕBܕBܕB..þÿÿÿ   þÿÿÿu˜ãŸÍЭsÓÒgßȧeŠŸ¯/&r'l…n ^­zTÚvy÷5ÿÿÿÿgƒƒÝ ’jËã)EÎYw¹)ù”ÚœÕ_¯¢•Ì½EÒW¿þ|/žÞZƼ J¦ãÔØU*ÙøDØàÿˆÓ{Ž«3z¹ÐëHV˜³FEDîCþ :‰ç˵Tl%ÚòÞäêþè"~'Êìþ‚!Œ@1i@óÓx[ŸpxfÚ¶CÏOˆ_§Ö‡£BÛKíí6ÐՆsôÎÿ@tQŒðòS\Á…kŸÈtÁA!¤ð·=ñÄ}/ìvHâ`˜Qÿà,ÂÅXtVXÙSYÊpâé̈„®ú`wt0B‰YåÆæ ±îbmSs’/ñÕÜÂ/9{êÃ[&AÍréªíð¡Öx»nzˆN—e±Ag8¿n=ëºn_]W;éÆ î¹ýèÀTk1áVϤÍH—BÙØg5C´÷1æž"ÉÍÙèÌøA²ãép·|wðïÀ¢cSa&Ù¤ÏVvv@²¸^Š=£¡˜Æà#°ðrÆN, H¦³¬1¾Gò ¤8Qmη˜t̽!OKP`¡É»R½òÕ;“ØÕá _["Šx HÃ,tª¹‡kHy îÞ?øÿ¥ë5ÆááQÿt¡žx0y¡mu“jRžÙŽn]àÆK’¬0"ÀÄí>ßH<~ɽ:yʉ‰Š)d¼Nz”ÆPûÁ×o baJ.|º<…dh©8þçå_–…qRé íß¿iË®üäù´(“dC>n8y¶˜wx«|^B.?AVbad_exception@std@@|^B.?AVexception@std@@|^B.?AVtype_info@@
base_address: 0x00428000
process_identifier: 2692
process_handle: 0x0000002c
1 1 0

WriteProcessMemory

 buffer: €0€ H`°}<?xml version='1.0' encoding='UTF-8' standalone='yes'?> <assembly xmlns='urn:schemas-microsoft-com:asm.v1' manifestVersion='1.0'> <trustInfo xmlns="urn:schemas-microsoft-com:asm.v3"> <security> <requestedPrivileges> <requestedExecutionLevel level='asInvoker' uiAccess='false' /> </requestedPrivileges> </security> </trustInfo> </assembly>
base_address: 0x0042b000
process_identifier: 2692
process_handle: 0x0000002c
1 1 0

WriteProcessMemory

 buffer:
base_address: 0x0042c000
process_identifier: 2692
process_handle: 0x0000002c
1 1 0

WriteProcessMemory

 buffer: @
base_address: 0xfffde008
process_identifier: 2692
process_handle: 0x0000002c
1 1 0

NtSetContextThread

 registers.eip: 1995571652
registers.esp: 3014260
registers.edi: 0
registers.eax: 4198977
registers.ebp: 0
registers.edx: 0
registers.ebx: -139264
registers.esi: 0
registers.ecx: 0
thread_handle: 0x00000020
process_identifier: 2692
1 0 0

NtResumeThread

 thread_handle: 0x00000020
suspend_count: 1
process_identifier: 2692
1 0 0