Summary | ZeroBOX

Category	Machine	Started	Completed
FILE	s1_win7_x6401	Sept. 22, 2023, 10:46 a.m.	Sept. 22, 2023, 10:48 a.m.

Size	1.0MB
Type	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
MD5	`5a8434f899549874f8114dda6a6e2763`
SHA256	`83006c24730b2d7fb7506451aee3d6bb85cc27d64e230630bc66517c7ba9ed21`
CRC32	`15452A10`
ssdeep	`24576:Eaynkc1ZzBvtrZHFjMKY2GocjuN6Yelp+QlGVB/yqR:1ynkc1ZzBvtrZHFjMKY2kjuN6Yelpju`
Yara	Malicious_Library_Zero - Malicious_Library UPX_Zero - UPX packed file PE_Header_Zero - PE File Signature Network_Downloader - File Downloader IsPE32 - (no description) Antivirus - Contains references to security software Is_DotNET_EXE - (no description) Win32_Trojan_PWS_Net_1_Zero - Win32 Trojan PWS .NET Azorult Malicious_Packer_Zero - Malicious Packer OS_Processor_Check_Zero - OS Processor Check Generic_Malware_Zero - Generic Malware

cmd.exe cmd /c ""C:\Users\test22\AppData\Local\Temp\cL1uri9w72Ul.bat" "
2892
- chcp.com chcp 65001
  2960
- PING.EXE ping -n 10 localhost
  3004
cmd.exe cmd /c ""C:\Users\test22\AppData\Local\Temp\QoBAwJxWt3rA.bat" "
676
- chcp.com chcp 65001
  2708
- PING.EXE ping -n 10 localhost
  2316
- 5a8434f899549874f8114dda6a6e2763.exe "C:\Users\test22\AppData\Local\Temp\5a8434f899549874f8114dda6a6e2763.exe"
  1316

Name	Response	Post-Analysis Lookup
No hosts contacted.

IP Address	Status	Action
No hosts contacted.

Suricata Alerts

No Suricata Alerts

Suricata TLS

No Suricata TLS

Checks if process is being debugged by a debugger (2 events)

Time & API	Arguments	Status	Return	Repeated
IsDebuggerPresent Sept. 22, 2023, 10:48 a.m.			0	0
IsDebuggerPresent Sept. 22, 2023, 10:48 a.m.			0	0

Command line console output was observed (6 events)

Time & API	Arguments	Status	Return
WriteConsoleW Sept. 22, 2023, 10:47 a.m.	buffer: DONT CLOSE THIS WINDOW! console_handle: 0x00000007	1	1
WriteConsoleW Sept. 22, 2023, 10:47 a.m.	buffer: The batch file cannot be found. console_handle: 0x0000000b	1	1
WriteConsoleW Sept. 22, 2023, 10:47 a.m.	buffer: Active code page: 65001 console_handle: 0x00000013	1	1
WriteConsoleW Sept. 22, 2023, 10:48 a.m.	buffer: DONT CLOSE THIS WINDOW! console_handle: 0x00000007	1	1
WriteConsoleW Sept. 22, 2023, 10:48 a.m.	buffer: The batch file cannot be found. console_handle: 0x0000000b	1	1
WriteConsoleW Sept. 22, 2023, 10:48 a.m.	buffer: Active code page: 65001 console_handle: 0x00000013	1	1

Checks amount of memory in system, this can be used to detect virtual machines that have a low amount of memory available (1 event)

Time & API	Arguments	Status	Return	Repeated
GlobalMemoryStatusEx Sept. 22, 2023, 10:48 a.m.		1	1	0

Allocates read-write-execute memory (usually to unpack itself) (14 events)

Time & API	Arguments	Status
NtAllocateVirtualMemory Sept. 22, 2023, 10:48 a.m.	process_identifier: 1316 region_size: 1835008 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x006c0000 allocation_type: 8192 (MEM_RESERVE) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Sept. 22, 2023, 10:48 a.m.	process_identifier: 1316 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00840000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtProtectVirtualMemory Sept. 22, 2023, 10:48 a.m.	process_identifier: 1316 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x727a1000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Sept. 22, 2023, 10:48 a.m.	process_identifier: 1316 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x727a2000 process_handle: 0xffffffff	1
NtAllocateVirtualMemory Sept. 22, 2023, 10:48 a.m.	process_identifier: 1316 region_size: 655360 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x005b0000 allocation_type: 8192 (MEM_RESERVE) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Sept. 22, 2023, 10:48 a.m.	process_identifier: 1316 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00610000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Sept. 22, 2023, 10:48 a.m.	process_identifier: 1316 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00552000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Sept. 22, 2023, 10:48 a.m.	process_identifier: 1316 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00585000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Sept. 22, 2023, 10:48 a.m.	process_identifier: 1316 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0058b000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Sept. 22, 2023, 10:48 a.m.	process_identifier: 1316 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00587000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Sept. 22, 2023, 10:48 a.m.	process_identifier: 1316 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0056c000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Sept. 22, 2023, 10:48 a.m.	process_identifier: 1316 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x006a0000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Sept. 22, 2023, 10:48 a.m.	process_identifier: 1316 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0055a000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Sept. 22, 2023, 10:48 a.m.	process_identifier: 1316 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00576000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1

Yara rule detected in process memory (50 out of 51 events)

description	Create a windows service	rule	Create_Service
description	Communications over RAW Socket	rule	Network_TCP_Socket
description	Communications over P2P network	rule	Network_P2P_Win
description	Communication using DGA	rule	Network_DGA
description	Steal credential	rule	local_credential_Steal
description	Match Windows Http API call	rule	Str_Win32_Http_API
description	Escalate priviledges	rule	Escalate_priviledges
description	task schedule	rule	schtasks_Zero
description	PWS Memory	rule	Generic_PWS_Memory_Zero
description	Record Audio	rule	Sniff_Audio
description	Communications over HTTP	rule	Network_HTTP
description	Communications use DNS	rule	Network_DNS
description	Take ScreenShot	rule	ScreenShot
description	Code injection with CreateRemoteThread in a remote process	rule	Code_injection
description	Match Windows Inet API call	rule	Str_Win32_Internet_API
description	(no description)	rule	DebuggerCheck__GlobalFlags
description	(no description)	rule	DebuggerCheck__QueryInfo
description	(no description)	rule	DebuggerCheck__RemoteAPI
description	(no description)	rule	DebuggerHiding__Thread
description	(no description)	rule	DebuggerHiding__Active
description	(no description)	rule	DebuggerException__ConsoleCtrl
description	(no description)	rule	DebuggerException__SetConsoleCtrl
description	(no description)	rule	ThreadControl__Context
description	(no description)	rule	SEH__vectored
description	(no description)	rule	Check_Dlls
description	Detection of Virtual Appliances through the use of WMI for use of evasion.	rule	WMI_VM_Detect
description	Checks if being debugged	rule	anti_dbg
description	Anti-Sandbox checks for ThreatExpert	rule	antisb_threatExpert
description	Bypass DEP	rule	disable_dep
description	Affect hook table	rule	win_hook
description	Communications over FTP	rule	Network_FTP
description	Run a KeyLogger	rule	KeyLogger
description	File Downloader	rule	Network_Downloader
description	task schedule	rule	schtasks_Zero
description	PWS Memory	rule	Generic_PWS_Memory_Zero
description	Record Audio	rule	Sniff_Audio
description	Communications use DNS	rule	Network_DNS
description	Take ScreenShot	rule	ScreenShot
description	Code injection with CreateRemoteThread in a remote process	rule	Code_injection
description	(no description)	rule	DebuggerCheck__GlobalFlags
description	(no description)	rule	DebuggerCheck__QueryInfo
description	(no description)	rule	DebuggerHiding__Thread
description	(no description)	rule	DebuggerHiding__Active
description	(no description)	rule	ThreadControl__Context
description	(no description)	rule	SEH__vectored
description	Detection of Virtual Appliances through the use of WMI for use of evasion.	rule	WMI_VM_Detect
description	Checks if being debugged	rule	anti_dbg
description	Bypass DEP	rule	disable_dep
description	Affect hook table	rule	win_hook
description	Run a KeyLogger	rule	KeyLogger

Uses Windows utilities for basic Windows functionality (2 events)

cmdline	ping -n 10 localhost
cmdline	chcp 65001

Resumed a suspended thread in a remote process potentially indicative of process injection (4 events)

Time & API	Arguments	Status	Return	Repeated
Process injection	Process 2892 resumed a thread in remote process 2120
Process injection	Process 676 resumed a thread in remote process 1316
NtResumeThread Sept. 22, 2023, 10:47 a.m.	thread_handle: 0x00000084 suspend_count: 0 process_identifier: 2120	1	0	0
NtResumeThread Sept. 22, 2023, 10:48 a.m.	thread_handle: 0x00000084 suspend_count: 0 process_identifier: 1316	1	0	0

File has been identified by 59 AntiVirus engines on VirusTotal as malicious (50 out of 59 events)

Lionic	Trojan.Win32.Emotet.L!c
MicroWorld-eScan	IL:Trojan.MSILMamut.123
FireEye	Generic.mg.5a8434f899549874
CAT-QuickHeal	Trojan.Generic.TRFH301
ALYac	IL:Trojan.MSILMamut.123
Malwarebytes	Generic.Malware.AI.DDS
VIPRE	IL:Trojan.MSILMamut.123
Sangfor	Trojan.Win32.Save.a
K7AntiVirus	Trojan ( 0051816c1 )
Alibaba	Trojan:MSIL/ClipBanker.223a020a
K7GW	Trojan ( 0051816c1 )
CrowdStrike	win/malicious_confidence_100% (W)
Arcabit	IL:Trojan.MSILMamut.123
VirIT	Trojan.Win32.MSIL_Heur.B
Cyren	W32/Trojan.GPU.gen!Eldorado
Symantec	ML.Attribute.HighConfidence
Elastic	malicious (high confidence)
ESET-NOD32	a variant of MSIL/Agent.AIA
Cynet	Malicious (score: 100)
APEX	Malicious
ClamAV	Win.Malware.Ursu-9802322-0
Kaspersky	HEUR:Trojan.Win32.Generic
BitDefender	IL:Trojan.MSILMamut.123
NANO-Antivirus	Exploit.Win32.Bulz.kaykbi
SUPERAntiSpyware	Trojan.Agent/Gen-MSILHeracles
Avast	Win32:RATX-gen [Trj]
Tencent	Expt.Msil.Uac.pa
Emsisoft	Trojan.Agent (A)
F-Secure	Trojan.TR/Dropper.MSIL.Gen
DrWeb	BackDoor.VoidRATNET.1
Zillya	Trojan.Agent.Win32.2826775
TrendMicro	TROJ_GEN.R002C0DII23
McAfee-GW-Edition	BehavesLike.Win32.Generic.th
Sophos	Mal/Monev-A
Ikarus	Trojan.MSIL.Agent
Jiangmin	Trojan.Generic.guvhw
Avira	TR/Dropper.MSIL.Gen
MAX	malware (ai score=88)
Antiy-AVL	Trojan[Exploit]/MSIL.UAC
Gridinsoft	Backdoor.Win32.Quasar.bot
Xcitium	Malware@#34kl714tn32dp
Microsoft	Trojan:MSIL/ClipBanker.GC!MTB
ViRobot	Trojan.Win.Z.Agent.1085952.BL
ZoneAlarm	HEUR:Exploit.MSIL.UAC.gen
GData	IL:Trojan.MSILMamut.123
Google	Detected
AhnLab-V3	Trojan/Win.Generic.C4455467
McAfee	GenericRXOE-JA!5A8434F89954
VBA32	Trojan.MSIL.DLAgent10.Heur
Cylance	unsafe

5a8434f899549874f8114dda6a6e2763.exe

Process Tree Toggle all

Network Toggle all

Suricata Toggle all

Suricata Alerts

Suricata TLS

Signatures Toggle All