popup
Summary | ZeroBOX
  1. Home
  2. Result
  3. Report
  4. Detail Analysis

exto.exe

UPX task schedule Malicious Library HTTP Internet API Http API PWS AntiDebug PE File OS Processor Check PE32 AntiVM
  1. Resubmit sample
Category Machine Started Completed
FILE s1_win7_x6401 Sept. 24, 2023, 11:17 a.m. Sept. 24, 2023, 11:21 a.m.
Size 364.5KB
Type PE32 executable (GUI) Intel 80386, for MS Windows
MD5 9379586a4b035658785cc87c8292d6df
SHA256 7c6b4b0f3a0ebcf30390f2332379a1ff18062f9d5595adb6e628f336a2b56a0b
CRC32 282E3D81
ssdeep 6144:K146fuYXChoQTjlFgLuCY1dRuAOaPAS1N54CRNAsVFwhFuOfRH4MIS09Fvw8y0:KCYzXChdTbv1buUAS1RRNAsVFTOZHx44
Yara
  • Malicious_Library_Zero - Malicious_Library
  • UPX_Zero - UPX packed file
  • PE_Header_Zero - PE File Signature
  • IsPE32 - (no description)
  • OS_Processor_Check_Zero - OS Processor Check

Name Response Post-Analysis Lookup
No hosts contacted.
IP Address Status Action
5.42.92.211 Active Moloch

Suricata Alerts

Flow SID Signature Category
TCP 192.168.56.101:49164 -> 5.42.92.211:80 2047625 ET MALWARE [ANY.RUN] Win32/Stealc Checkin (POST) A Network Trojan was detected
TCP 192.168.56.101:49164 -> 5.42.92.211:80 2018358 ET HUNTING GENERIC SUSPICIOUS POST to Dotted Quad with Fake Browser 1 Potentially Bad Traffic

Suricata TLS

No Suricata TLS

section .syhua
suspicious_features POST method with no referer header, Connection to IP address suspicious_request POST http://5.42.92.211/loghub/master
request POST http://5.42.92.211/loghub/master
request POST http://5.42.92.211/loghub/master
Time & API Arguments Status Return Repeated

NtProtectVirtualMemory

 process_identifier: 2676
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x75d41000
process_handle: 0xffffffff
1 0 0

NtProtectVirtualMemory

 process_identifier: 2676
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x75e61000
process_handle: 0xffffffff
1 0 0

NtProtectVirtualMemory

 process_identifier: 2676
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x76161000
process_handle: 0xffffffff
1 0 0
description Match Windows Http API call rule Str_Win32_Http_API
description task schedule rule schtasks_Zero
description PWS Memory rule Generic_PWS_Memory_Zero
description Communications over HTTP rule Network_HTTP
description Match Windows Inet API call rule Str_Win32_Internet_API
description (no description) rule DebuggerCheck__GlobalFlags
description (no description) rule DebuggerCheck__QueryInfo
description (no description) rule DebuggerHiding__Thread
description (no description) rule DebuggerHiding__Active
description (no description) rule ThreadControl__Context
description (no description) rule SEH__vectored
description Checks if being debugged rule anti_dbg
description Bypass DEP rule disable_dep
host 5.42.92.211
Time & API Arguments Status Return Repeated

NtAllocateVirtualMemory

 process_identifier: 2676
region_size: 180224
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x00400000
allocation_type: 12288 (MEM_COMMIT|MEM_RESERVE)
process_handle: 0x0000003c
1 0 0
Time & API Arguments Status Return Repeated

WriteProcessMemory

 buffer: MZÿÿ¸@º´ Í!¸LÍ!This program cannot be run in DOS mode. $àž ¤ÿmY¤ÿmY¤ÿmYwnX¨ÿmYwhX2ÿmYwiX°ÿmYY¦ÿmYhX‚ÿmYiXµÿmYnX°ÿmYwlX§ÿmY¤ÿlYðÿmY°€dX´ÿmY°€’Y¥ÿmY°€oX¥ÿmYRich¤ÿmYPELGáeà $¸ÈAÐ@À@LE(€à¨'À::@Ð.text¶¸ `.rdatax{Ð|¼@@.data¸!P 8@À.rsrcà€D@@.reloc¨'(F@B
base_address: 0x00400000
process_identifier: 2676
process_handle: 0x0000003c
1 1 0

WriteProcessMemory

 buffer: ÿÿÿÿ±¿DNæ@»ÿÿÿÿ “ ÿÿÿÿ abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ¤`‚y‚!¦ß¡¥Ÿàü@~€ü¨Á£Ú£ þ@þµÁ£Ú£ þAþ¶Ï¢ä¢å¢è¢[þ@~¡þQQÚ^Ú _ÚjÚ2ÓØÞàù1~þ€êA@VB@VB@VB@VB@VBHVBíA€îAÀäA€UB`PBC˜VBˆeBˆeBˆeBˆeBˆeBˆeBˆeBˆeBˆeBœVBŒeBŒeBŒeBŒeBŒeBŒeBŒeB..þÿÿÿ   þÿÿÿu˜eõ›‡S®g¸†ímZ3mÜg>ãUl­3.¡Éê2ÔËöÿÿÿÿ ì”ï+z™/}Žâ1Æô“CñzÝÖîþî¶ð5—Õ\ ÅÕN­¡·rv¡­#5è¼ÐŽ“jXA²"]OZVKiX(üNƒ•\íº©ÿsæTžS<[eb?f} Àš®¼—`¢³²âgÇH,ÃU’í¾çJkî]çƱ{ò · g×->sДÇ䌸5åÉ7åxªôLÆKÔïhP˜ º[¨ m»›ÚwÍÄ aˆ ?>° ’©'¸v _ˆ¶i( ÖhI´gV (¶'{µ²„±W’5$Ö定¥sÇ¿c°Úf!Äeå¢ºÀaÕpL߂š¤ Ä_8IbM$¾¾è0qe˜B Y¾v:rŸq;‹d|ìŠÊ)šØuŽaq¤1»/´ÝeWÞf¤ˆ’tTãÁ§q’]c-´çž{ À’¹ûi€Qºwç}n_/µÓ€dœ“Z¢“8‘N'óò¶¿Ðé¾0א¾ˆ* ¹R·'3øÓß´ãŸø‰¾®h™ij²:•éà³ó^åáPV†$w`g¯ ãšÏ›c0jªÖë¦EÐUQ’‰YIG_€³W¤÷ú£ ”ÔD¶lwðãëC?HGܵ !®‚x>¤ÁZúË»` ë6tA|B.?AVbad_exception@std@@|B.?AVexception@std@@|B.?AVtype_info@@
base_address: 0x00425000
process_identifier: 2676
process_handle: 0x0000003c
1 1 0

WriteProcessMemory

 buffer: €0€ H`€}<?xml version='1.0' encoding='UTF-8' standalone='yes'?> <assembly xmlns='urn:schemas-microsoft-com:asm.v1' manifestVersion='1.0'> <trustInfo xmlns="urn:schemas-microsoft-com:asm.v3"> <security> <requestedPrivileges> <requestedExecutionLevel level='asInvoker' uiAccess='false' /> </requestedPrivileges> </security> </trustInfo> </assembly>
base_address: 0x00428000
process_identifier: 2676
process_handle: 0x0000003c
1 1 0

WriteProcessMemory

 buffer: @
base_address: 0xfffde008
process_identifier: 2676
process_handle: 0x0000003c
1 1 0
Time & API Arguments Status Return Repeated

WriteProcessMemory

 buffer: MZÿÿ¸@º´ Í!¸LÍ!This program cannot be run in DOS mode. $àž ¤ÿmY¤ÿmY¤ÿmYwnX¨ÿmYwhX2ÿmYwiX°ÿmYY¦ÿmYhX‚ÿmYiXµÿmYnX°ÿmYwlX§ÿmY¤ÿlYðÿmY°€dX´ÿmY°€’Y¥ÿmY°€oX¥ÿmYRich¤ÿmYPELGáeà $¸ÈAÐ@À@LE(€à¨'À::@Ð.text¶¸ `.rdatax{Ð|¼@@.data¸!P 8@À.rsrcà€D@@.reloc¨'(F@B
base_address: 0x00400000
process_identifier: 2676
process_handle: 0x0000003c
1 1 0
Process injection Process 2564 called NtSetContextThread to modify thread in remote process 2676
Time & API Arguments Status Return Repeated

NtSetContextThread

 registers.eip: 1995571652
registers.esp: 3866208
registers.edi: 0
registers.eax: 4198977
registers.ebp: 0
registers.edx: 0
registers.ebx: -139264
registers.esi: 0
registers.ecx: 0
thread_handle: 0x00000038
process_identifier: 2676
1 0 0
Process injection Process 2564 resumed a thread in remote process 2676
Time & API Arguments Status Return Repeated

NtResumeThread

 thread_handle: 0x00000038
suspend_count: 1
process_identifier: 2676
1 0 0
Time & API Arguments Status Return Repeated

CreateProcessInternalW

 thread_identifier: 2680
thread_handle: 0x00000038
process_identifier: 2676
current_directory:
filepath: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
track: 1
command_line:
filepath_r: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
stack_pivoted: 0
creation_flags: 4 (CREATE_SUSPENDED)
inherit_handles: 0
process_handle: 0x0000003c
1 1 0

NtGetContextThread

 thread_handle: 0x00000038
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2676
region_size: 180224
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x00400000
allocation_type: 12288 (MEM_COMMIT|MEM_RESERVE)
process_handle: 0x0000003c
1 0 0

WriteProcessMemory

 buffer: MZÿÿ¸@º´ Í!¸LÍ!This program cannot be run in DOS mode. $àž ¤ÿmY¤ÿmY¤ÿmYwnX¨ÿmYwhX2ÿmYwiX°ÿmYY¦ÿmYhX‚ÿmYiXµÿmYnX°ÿmYwlX§ÿmY¤ÿlYðÿmY°€dX´ÿmY°€’Y¥ÿmY°€oX¥ÿmYRich¤ÿmYPELGáeà $¸ÈAÐ@À@LE(€à¨'À::@Ð.text¶¸ `.rdatax{Ð|¼@@.data¸!P 8@À.rsrcà€D@@.reloc¨'(F@B
base_address: 0x00400000
process_identifier: 2676
process_handle: 0x0000003c
1 1 0

WriteProcessMemory

 buffer:
base_address: 0x00401000
process_identifier: 2676
process_handle: 0x0000003c
1 1 0

WriteProcessMemory

 buffer:
base_address: 0x0041d000
process_identifier: 2676
process_handle: 0x0000003c
1 1 0

WriteProcessMemory

 buffer: ÿÿÿÿ±¿DNæ@»ÿÿÿÿ “ ÿÿÿÿ abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ¤`‚y‚!¦ß¡¥Ÿàü@~€ü¨Á£Ú£ þ@þµÁ£Ú£ þAþ¶Ï¢ä¢å¢è¢[þ@~¡þQQÚ^Ú _ÚjÚ2ÓØÞàù1~þ€êA@VB@VB@VB@VB@VBHVBíA€îAÀäA€UB`PBC˜VBˆeBˆeBˆeBˆeBˆeBˆeBˆeBˆeBˆeBœVBŒeBŒeBŒeBŒeBŒeBŒeBŒeB..þÿÿÿ   þÿÿÿu˜eõ›‡S®g¸†ímZ3mÜg>ãUl­3.¡Éê2ÔËöÿÿÿÿ ì”ï+z™/}Žâ1Æô“CñzÝÖîþî¶ð5—Õ\ ÅÕN­¡·rv¡­#5è¼ÐŽ“jXA²"]OZVKiX(üNƒ•\íº©ÿsæTžS<[eb?f} Àš®¼—`¢³²âgÇH,ÃU’í¾çJkî]çƱ{ò · g×->sДÇ䌸5åÉ7åxªôLÆKÔïhP˜ º[¨ m»›ÚwÍÄ aˆ ?>° ’©'¸v _ˆ¶i( ÖhI´gV (¶'{µ²„±W’5$Ö定¥sÇ¿c°Úf!Äeå¢ºÀaÕpL߂š¤ Ä_8IbM$¾¾è0qe˜B Y¾v:rŸq;‹d|ìŠÊ)šØuŽaq¤1»/´ÝeWÞf¤ˆ’tTãÁ§q’]c-´çž{ À’¹ûi€Qºwç}n_/µÓ€dœ“Z¢“8‘N'óò¶¿Ðé¾0א¾ˆ* ¹R·'3øÓß´ãŸø‰¾®h™ij²:•éà³ó^åáPV†$w`g¯ ãšÏ›c0jªÖë¦EÐUQ’‰YIG_€³W¤÷ú£ ”ÔD¶lwðãëC?HGܵ !®‚x>¤ÁZúË»` ë6tA|B.?AVbad_exception@std@@|B.?AVexception@std@@|B.?AVtype_info@@
base_address: 0x00425000
process_identifier: 2676
process_handle: 0x0000003c
1 1 0

WriteProcessMemory

 buffer: €0€ H`€}<?xml version='1.0' encoding='UTF-8' standalone='yes'?> <assembly xmlns='urn:schemas-microsoft-com:asm.v1' manifestVersion='1.0'> <trustInfo xmlns="urn:schemas-microsoft-com:asm.v3"> <security> <requestedPrivileges> <requestedExecutionLevel level='asInvoker' uiAccess='false' /> </requestedPrivileges> </security> </trustInfo> </assembly>
base_address: 0x00428000
process_identifier: 2676
process_handle: 0x0000003c
1 1 0

WriteProcessMemory

 buffer:
base_address: 0x00429000
process_identifier: 2676
process_handle: 0x0000003c
1 1 0

WriteProcessMemory

 buffer: @
base_address: 0xfffde008
process_identifier: 2676
process_handle: 0x0000003c
1 1 0

NtSetContextThread

 registers.eip: 1995571652
registers.esp: 3866208
registers.edi: 0
registers.eax: 4198977
registers.ebp: 0
registers.edx: 0
registers.ebx: -139264
registers.esi: 0
registers.ecx: 0
thread_handle: 0x00000038
process_identifier: 2676
1 0 0

NtResumeThread

 thread_handle: 0x00000038
suspend_count: 1
process_identifier: 2676
1 0 0