Summary | ZeroBOX

Category	Machine	Started	Completed
FILE	s1_win7_x6403_us	Sept. 30, 2023, 12:52 p.m.	Sept. 30, 2023, 12:58 p.m.

Size	2.2MB
Type	PE32 executable (GUI) Intel 80386, for MS Windows
MD5	`38682480c0a22cc8e025f23d78bab140`
SHA256	`b9e5e994a4842267fbbb169667da1a5e19b1be4f10bb8963cf90e9dbf03c2b6b`
CRC32	`4E98718D`
ssdeep	`49152:mcBzX10t+zDHZvSy0wcxD+WDoms4WAjrHSROCuiloiBY:myX10035vSdhlQmsd2HcOCuilo1`
Yara	Malicious_Library_Zero - Malicious_Library PE_Header_Zero - PE File Signature IsPE32 - (no description)

herom.exe "C:\Users\test22\AppData\Local\Temp\herom.exe"
1000
- cmd.exe cmd /c .\Ps9stMIW.CMd
  316
  - control.exe CONTroL.exe "C:\Users\test22\AppData\Local\Temp\7zS8E33ADEA\c_sj.7DU"
    2124
    - rundll32.exe "C:\Windows\system32\rundll32.exe" Shell32.dll,Control_RunDLL "C:\Users\test22\AppData\Local\Temp\7zS8E33ADEA\c_sj.7DU"
      2180
      - rundll32.exe C:\Windows\system32\RunDll32.exe Shell32.dll,Control_RunDLL "C:\Users\test22\AppData\Local\Temp\7zS8E33ADEA\c_sj.7DU"
        2308
        
        rundll32.exe "C:\Windows\SysWOW64\rundll32.exe" "C:\Windows\SysWOW64\shell32.dll",#44 "C:\Users\test22\AppData\Local\Temp\7zS8E33ADEA\c_sj.7DU"
        2352

Name	Response	Post-Analysis Lookup
No hosts contacted.

IP Address	Status	Action
No hosts contacted.

Suricata Alerts

No Suricata Alerts

Suricata TLS

No Suricata TLS

Checks if process is being debugged by a debugger (3 events)

Time & API	Arguments	Status	Return	Repeated
IsDebuggerPresent Sept. 30, 2023, 12:52 p.m.			0	0
IsDebuggerPresent Sept. 30, 2023, 12:45 p.m.			0	0
IsDebuggerPresent Sept. 30, 2023, 12:52 p.m.			0	0

Command line console output was observed (3 events)

Time & API	Arguments	Status	Return
WriteConsoleW Sept. 30, 2023, 12:52 p.m.	buffer: C:\Users\test22\AppData\Local\Temp\7zS8E33ADEA> console_handle: 0x00000007	1	1
WriteConsoleW Sept. 30, 2023, 12:52 p.m.	buffer: CONTroL.exe console_handle: 0x00000007	1	1
WriteConsoleW Sept. 30, 2023, 12:52 p.m.	buffer: "C:\Users\test22\AppData\Local\Temp\7zS8E33ADEA\c_sj.7DU" console_handle: 0x00000007	1	1

Checks amount of memory in system, this can be used to detect virtual machines that have a low amount of memory available (1 event)

Time & API	Arguments	Status	Return	Repeated
GlobalMemoryStatusEx Sept. 30, 2023, 12:52 p.m.		1	1	0

The executable contains unknown PE section names indicative of a packer (could be a false positive) (1 event)

section

.sxdata

The executable uses a known packer (1 event)

packer

Armadillo v1.71

Allocates read-write-execute memory (usually to unpack itself) (28 events)

Time & API	Arguments	Status
NtProtectVirtualMemory Sept. 30, 2023, 12:52 p.m.	process_identifier: 2180 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x74630000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Sept. 30, 2023, 12:52 p.m.	process_identifier: 2180 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x744b1000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Sept. 30, 2023, 12:52 p.m.	process_identifier: 2180 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x1000c000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Sept. 30, 2023, 12:52 p.m.	process_identifier: 2180 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x74111000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Sept. 30, 2023, 12:52 p.m.	process_identifier: 2180 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x740f1000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Sept. 30, 2023, 12:52 p.m.	process_identifier: 2180 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x740b1000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Sept. 30, 2023, 12:52 p.m.	process_identifier: 2180 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x75931000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Sept. 30, 2023, 12:52 p.m.	process_identifier: 2180 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x76e01000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Sept. 30, 2023, 12:52 p.m.	process_identifier: 2180 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x752e1000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Sept. 30, 2023, 12:52 p.m.	process_identifier: 2180 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x76971000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Sept. 30, 2023, 12:52 p.m.	process_identifier: 2180 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x74051000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Sept. 30, 2023, 12:52 p.m.	process_identifier: 2180 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x74031000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Sept. 30, 2023, 12:52 p.m.	process_identifier: 2180 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x758f1000 process_handle: 0xffffffff	1
NtAllocateVirtualMemory Sept. 30, 2023, 12:52 p.m.	process_identifier: 2180 region_size: 24576 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x006b0000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtProtectVirtualMemory Sept. 30, 2023, 12:52 p.m.	process_identifier: 2352 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x74630000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Sept. 30, 2023, 12:52 p.m.	process_identifier: 2352 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x744b1000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Sept. 30, 2023, 12:52 p.m.	process_identifier: 2352 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x1000c000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Sept. 30, 2023, 12:52 p.m.	process_identifier: 2352 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x740d1000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Sept. 30, 2023, 12:52 p.m.	process_identifier: 2352 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x74131000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Sept. 30, 2023, 12:52 p.m.	process_identifier: 2352 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x74091000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Sept. 30, 2023, 12:52 p.m.	process_identifier: 2352 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x75931000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Sept. 30, 2023, 12:52 p.m.	process_identifier: 2352 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x76e01000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Sept. 30, 2023, 12:52 p.m.	process_identifier: 2352 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x752e1000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Sept. 30, 2023, 12:52 p.m.	process_identifier: 2352 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x76971000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Sept. 30, 2023, 12:52 p.m.	process_identifier: 2352 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x74031000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Sept. 30, 2023, 12:52 p.m.	process_identifier: 2352 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x74111000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Sept. 30, 2023, 12:52 p.m.	process_identifier: 2352 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x758f1000 process_handle: 0xffffffff	1
NtAllocateVirtualMemory Sept. 30, 2023, 12:52 p.m.	process_identifier: 2352 region_size: 24576 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00910000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1

Creates executable files on the filesystem (1 event)

file	C:\Users\test22\AppData\Local\Temp\7zS8E33ADEA\Ps9stMiw.cmd

Drops an executable to the user AppData folder (1 event)

file	C:\Users\test22\AppData\Local\Temp\7zS8E33ADEA\c_sj.7dU

File has been identified by 16 AntiVirus engines on VirusTotal as malicious (16 events)

Bkav	W32.AIDetectMalware
Elastic	malicious (moderate confidence)
Cyren	W32/Kryptik.KSH.gen!Eldorado
APEX	Malicious
Kaspersky	VHO:Trojan.Win32.Zenpak.gen
NANO-Antivirus	Virus.Win32.Gen.ccmw
Avast	Win32:Evo-gen [Trj]
SentinelOne	Static AI - Suspicious SFX
Microsoft	Program:Win32/Wacapew.C!ml
ZoneAlarm	VHO:Trojan.Win32.Zenpak.gen
Google	Detected
Rising	Trojan.Generic@AI.100 (RDML:zMSm0FO4c8PqehHvUGiUXw)
Fortinet	W32/Kryptik.HUEI!tr
BitDefenderTheta	Gen:NN.ZedlaF.36738.qA8@aa!AY1ni
AVG	Win32:Evo-gen [Trj]
DeepInstinct	MALICIOUS

herom.exe

Process Tree Toggle all

Network Toggle all

Suricata Toggle all

Suricata Alerts

Suricata TLS

Signatures Toggle All