Summary | ZeroBOX

Category	Machine	Started	Completed
FILE	s1_win7_x6403_us	Oct. 10, 2023, 7:37 a.m.	Oct. 10, 2023, 7:45 a.m.

Size	47.5KB
Type	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
MD5	`edc44d75d9e3205cbd90be3d8352f504`
SHA256	`188599d3566db6b2a16fbc7a8ca1fc58a3a92a75522a13beb4f0cb2f8cd1da7d`
CRC32	`C5339B6D`
ssdeep	`768:taIO5VILWCyh+DiP1IU81l/4iU08YbEgeSHT2MI7vEgK/JzZVc6KN:taPNdIT9zbLfHXI7nkJzZVclN`
Yara	Malicious_Library_Zero - Malicious_Library UPX_Zero - UPX packed file Malicious_Packer_Zero - Malicious Packer PE_Header_Zero - PE File Signature IsPE32 - (no description) Antivirus - Contains references to security software Is_DotNET_EXE - (no description) Win32_Trojan_PWS_Net_1_Zero - Win32 Trojan PWS .NET Azorult OS_Processor_Check_Zero - OS Processor Check

windows.exe "C:\Users\test22\AppData\Local\Temp\windows.exe"
292

Name	Response	Post-Analysis Lookup
No hosts contacted.

IP Address	Status	Action
99.86.207.30	Active	Moloch

Suricata Alerts

No Suricata Alerts

Suricata TLS

No Suricata TLS

Checks if process is being debugged by a debugger (2 events)

Time & API	Arguments	Status	Return	Repeated
IsDebuggerPresent Oct. 10, 2023, 7:37 a.m.			0	0
IsDebuggerPresent Oct. 10, 2023, 7:37 a.m.			0	0

Checks amount of memory in system, this can be used to detect virtual machines that have a low amount of memory available (1 event)

Time & API	Arguments	Status	Return	Repeated
GlobalMemoryStatusEx Oct. 10, 2023, 7:37 a.m.		1	1	0

Allocates read-write-execute memory (usually to unpack itself) (34 events)

Time & API	Arguments	Status
NtAllocateVirtualMemory Oct. 10, 2023, 7:37 a.m.	process_identifier: 292 region_size: 2097152 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0000000000710000 allocation_type: 8192 (MEM_RESERVE) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory Oct. 10, 2023, 7:37 a.m.	process_identifier: 292 region_size: 8192 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0000000000890000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory Oct. 10, 2023, 7:37 a.m.	process_identifier: 292 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fef3601000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory Oct. 10, 2023, 7:37 a.m.	process_identifier: 292 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fef3c9b000 process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory Oct. 10, 2023, 7:37 a.m.	process_identifier: 292 region_size: 2162688 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00000000022c0000 allocation_type: 8192 (MEM_RESERVE) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory Oct. 10, 2023, 7:37 a.m.	process_identifier: 292 region_size: 8192 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0000000002450000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory Oct. 10, 2023, 7:37 a.m.	process_identifier: 292 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fef3602000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory Oct. 10, 2023, 7:37 a.m.	process_identifier: 292 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fef3602000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory Oct. 10, 2023, 7:37 a.m.	process_identifier: 292 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fef3602000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory Oct. 10, 2023, 7:37 a.m.	process_identifier: 292 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fef3602000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory Oct. 10, 2023, 7:37 a.m.	process_identifier: 292 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fef3602000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory Oct. 10, 2023, 7:37 a.m.	process_identifier: 292 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fef3602000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory Oct. 10, 2023, 7:37 a.m.	process_identifier: 292 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fef3602000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory Oct. 10, 2023, 7:37 a.m.	process_identifier: 292 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fef3602000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory Oct. 10, 2023, 7:37 a.m.	process_identifier: 292 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fef3602000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory Oct. 10, 2023, 7:37 a.m.	process_identifier: 292 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fef3602000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory Oct. 10, 2023, 7:37 a.m.	process_identifier: 292 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fef3602000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory Oct. 10, 2023, 7:37 a.m.	process_identifier: 292 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fef3604000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory Oct. 10, 2023, 7:37 a.m.	process_identifier: 292 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fef3604000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory Oct. 10, 2023, 7:37 a.m.	process_identifier: 292 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fef3604000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory Oct. 10, 2023, 7:37 a.m.	process_identifier: 292 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fef3604000 process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory Oct. 10, 2023, 7:37 a.m.	process_identifier: 292 region_size: 655360 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fffff10000 allocation_type: 1056768 (MEM_RESERVE\|MEM_TOP_DOWN) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory Oct. 10, 2023, 7:37 a.m.	process_identifier: 292 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fffff10000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory Oct. 10, 2023, 7:37 a.m.	process_identifier: 292 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fffff10000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory Oct. 10, 2023, 7:37 a.m.	process_identifier: 292 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fffff20000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory Oct. 10, 2023, 7:37 a.m.	process_identifier: 292 region_size: 65536 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fffff00000 allocation_type: 1056768 (MEM_RESERVE\|MEM_TOP_DOWN) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory Oct. 10, 2023, 7:37 a.m.	process_identifier: 292 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fffff00000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory Oct. 10, 2023, 7:37 a.m.	process_identifier: 292 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fe93e7a000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory Oct. 10, 2023, 7:37 a.m.	process_identifier: 292 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fe93f2c000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory Oct. 10, 2023, 7:37 a.m.	process_identifier: 292 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fe93f56000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory Oct. 10, 2023, 7:37 a.m.	process_identifier: 292 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fe93f30000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory Oct. 10, 2023, 7:37 a.m.	process_identifier: 292 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fe93e8c000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory Oct. 10, 2023, 7:37 a.m.	process_identifier: 292 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fe93fa0000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory Oct. 10, 2023, 7:37 a.m.	process_identifier: 292 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fe93e9b000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1

Communicates with host for which no DNS query was performed (1 event)

host

99.86.207.30

File has been identified by 56 AntiVirus engines on VirusTotal as malicious (50 out of 56 events)

Lionic	Trojan.Win32.Crysan.4!c
MicroWorld-eScan	Trojan.GenericKDZ.74543
CAT-QuickHeal	Backdoor.MsilFC.S13564499
Skyhigh	BehavesLike.Win32.Generic.pm
ALYac	Trojan.GenericKDZ.74543
Malwarebytes	Generic.Trojan.MSIL.DDS
Zillya	Trojan.Agent.Win32.2140958
Sangfor	Suspicious.Win32.Save.a
Alibaba	Backdoor:MSIL/Vindor.e4d8db28
CrowdStrike	win/malicious_confidence_100% (W)
Arcabit	Trojan.Generic.D1232F
VirIT	Trojan.Win32.MSIL_Heur.A
Symantec	ML.Attribute.HighConfidence
Elastic	Windows.Trojan.DCRat
ESET-NOD32	a variant of MSIL/Agent.CFQ
Cynet	Malicious (score: 100)
APEX	Malicious
ClamAV	Win.Malware.Generickdz-9865912-0
Kaspersky	HEUR:Backdoor.MSIL.Crysan.gen
BitDefender	Trojan.GenericKDZ.74543
SUPERAntiSpyware	Trojan.Agent/GenericKD
Avast	Win32:BackdoorX-gen [Trj]
Tencent	Backdoor.MSIL.Crysan.hb
Emsisoft	Trojan.GenericKDZ.74543 (B)
F-Secure	Heuristic.HEUR/AGEN.1307404
DrWeb	BackDoor.AsyncRATNET.2
VIPRE	Trojan.GenericKDZ.74543
TrendMicro	Backdoor.MSIL.ASYNCRAT.SMYXDGUZ
Trapmine	suspicious.low.ml.score
FireEye	Generic.mg.edc44d75d9e3205c
Sophos	Troj/AsyncRat-B
SentinelOne	Static AI - Malicious PE
Jiangmin	Backdoor.MSIL.epln
Webroot	W32.Trojan.Gen
Varist	W32/MSIL_Agent.BTI.gen!Eldorado
Avira	HEUR/AGEN.1307404
MAX	malware (ai score=87)
Antiy-AVL	Trojan/MSIL.Agent
Kingsoft	malware.kb.c.1000
Microsoft	Trojan:Win32/Vindor!pz
ZoneAlarm	HEUR:Backdoor.MSIL.Crysan.gen
GData	MSIL.Backdoor.DCRat.C
Google	Detected
AhnLab-V3	Trojan/Win.Agent.C4526491
McAfee	PWS-FDHM!EDC44D75D9E3
VBA32	Trojan.MSIL.DarkCrystal.Heur
Cylance	unsafe
Panda	Trj/GdSda.A
Rising	Backdoor.AsyncRAT!1.C3F4 (CLASSIC)
Ikarus	Trojan.MSIL.Agent

windows.exe

Process Tree Toggle all

Network Toggle all

Suricata Toggle all

Suricata Alerts

Suricata TLS

Signatures Toggle All