popup
Summary | ZeroBOX
  1. Home
  2. Result
  3. Report
  4. Detail Analysis

madywarza2.1.exe

NSIS Malicious Library UPX PE File OS Processor Check PE32
  1. Resubmit sample
Category Machine Started Completed
FILE s1_win7_x6401 Oct. 3, 2023, 12:49 p.m. Oct. 3, 2023, 12:55 p.m.
Size 275.8KB
Type PE32 executable (GUI) Intel 80386, for MS Windows, Nullsoft Installer self-extracting archive
MD5 a8dcae0690c61f8517b877b5191fc388
SHA256 d5845fb6e5fb97ed020ef7affac7dbc381c53b12c8c223fd5f657795bd6bdea3
CRC32 DE7EA56B
ssdeep 6144:GnPdudwDNQS0In2UdV0FjpD4LBxrtUl58T7DlzJiB94:GnPdZJ2HjpMBvUl6vik
Yara
  • Malicious_Library_Zero - Malicious_Library
  • UPX_Zero - UPX packed file
  • PE_Header_Zero - PE File Signature
  • NSIS_Installer - Null Soft Installer
  • IsPE32 - (no description)

Name Response Post-Analysis Lookup
osiarus.duckdns.org
IP Address Status Action
164.124.101.2 Active Moloch

Suricata Alerts

Flow SID Signature Category
UDP 192.168.56.101:54148 -> 164.124.101.2:53 2042936 ET INFO DYNAMIC_DNS Query to a *.duckdns .org Domain Potentially Bad Traffic
UDP 192.168.56.101:54148 -> 164.124.101.2:53 2022918 ET INFO DYNAMIC_DNS Query to *.duckdns. Domain Misc activity

Suricata TLS

No Suricata TLS

Time & API Arguments Status Return Repeated

GlobalMemoryStatusEx

 1 1 0
section .ndata
domain osiarus.duckdns.org
Time & API Arguments Status Return Repeated

NtProtectVirtualMemory

 process_identifier: 2640
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x732a2000
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2740
region_size: 8192
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x00340000
allocation_type: 12288 (MEM_COMMIT|MEM_RESERVE)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2740
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x00350000
allocation_type: 12289 (MEM_COMMIT|MEM_RESERVE)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 1452
region_size: 65536
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x0000000004160000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffffffffffff
1 0 0
file C:\Users\test22\AppData\Local\Temp\kdnrm.exe
file C:\Users\test22\AppData\Roaming\cllhq\qavvfooksso.exe
file C:\Users\test22\AppData\Roaming\cllhq\qavvfooksso.exe
reg_key HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run\xhhdmmvrrbwwgp reg_value C:\Users\test22\AppData\Roaming\cllhq\qavvfooksso.exe "C:\Users\test22\AppData\Local\Temp\kdnrm.exe"
Process injection Process 2740 called NtSetContextThread to modify thread in remote process 2804
Time & API Arguments Status Return Repeated

NtSetContextThread

 registers.eip: 1995571652
registers.esp: 3997356
registers.edi: 0
registers.eax: 4216632
registers.ebp: 0
registers.edx: 0
registers.ebx: 2130567168
registers.esi: 0
registers.ecx: 0
thread_handle: 0x000000c0
process_identifier: 2804
1 0 0
Bkav W32.AIDetectMalware
Lionic Trojan.Win32.Agensla.4!c
Elastic malicious (high confidence)
MicroWorld-eScan Gen:Variant.Jaik.182440
FireEye Generic.mg.a8dcae0690c61f85
ALYac Gen:Variant.Jaik.182440
Malwarebytes Generic.Malware/Suspicious
Sangfor Trojan.Win32.Agent.Vjyw
CrowdStrike win/malicious_confidence_100% (W)
Arcabit Trojan.Jaik.D2C8A8
BitDefenderTheta Gen:NN.ZexaF.36738.oCW@ayRORImi
Symantec ML.Attribute.HighConfidence
ESET-NOD32 a variant of Win32/Injector.ETIO
APEX Malicious
Cynet Malicious (score: 100)
Kaspersky HEUR:Trojan.Win32.Strab.gen
BitDefender Gen:Variant.Jaik.182440
Avast Win32:InjectorX-gen [Trj]
Sophos Mal/Generic-S
F-Secure Heuristic.HEUR/AGEN.1337940
DrWeb Trojan.Loader.1550
VIPRE Gen:Variant.Jaik.182440
TrendMicro Backdoor.Win32.WARZONE.YXDJCZ
McAfee-GW-Edition BehavesLike.Win32.Generic.dc
Emsisoft Trojan.GenericKD.69562292 (B)
Ikarus Trojan.NSIS.Agent
Jiangmin Trojan.Fsysna.pez
Webroot W32.Strab.Gen
Avira HEUR/AGEN.1337940
Kingsoft malware.kb.a.975
Gridinsoft Trojan.Win32.WarzoneRAT.bot
Microsoft Backdoor:Win32/WarzoneRAT.GA!MTB
ZoneAlarm HEUR:Trojan.Win32.Strab.gen
GData Trojan.GenericKD.69562292
Google Detected
AhnLab-V3 Win-Trojan/Gandcrab08.Exp
McAfee Artemis!A8DCAE0690C6
MAX malware (ai score=88)
Cylance unsafe
Panda Trj/Chgt.AD
TrendMicro-HouseCall Backdoor.Win32.WARZONE.YXDJCZ
Rising Trojan.Generic@AI.100 (RDML:3gpc0FlAnaIL+wBHe6ifMg)
Fortinet W32/PossibleThreat
AVG Win32:InjectorX-gen [Trj]
Cybereason malicious.5a6c57
DeepInstinct MALICIOUS