popup
Summary | ZeroBOX
  1. Home
  2. Result
  3. Report
  4. Detail Analysis

nalo.exe

UPX Malicious Library AntiDebug PE File OS Processor Check PE32 AntiVM
  1. Resubmit sample
Category Machine Started Completed
FILE s1_win7_x6403_us Oct. 24, 2023, 7:41 a.m. Oct. 24, 2023, 7:48 a.m.
Size 1.8MB
Type PE32 executable (GUI) Intel 80386, for MS Windows
MD5 35ec78636adb2e2094fc506736d9ffe1
SHA256 aeddb4c728bb3abfe9d72f656d5f2abd57c4832b36610f2d640f110fabf72615
CRC32 23D35306
ssdeep 24576:sAfSUleUFp5iiIOgArsH6a9Dhvh6d96cl77HjI:NleUFp5PIIrO6a3vK95l77D
PDB Path C:\fwqf1i40yva\RevoInstall.pdb
Yara
  • Malicious_Library_Zero - Malicious_Library
  • UPX_Zero - UPX packed file
  • PE_Header_Zero - PE File Signature
  • IsPE32 - (no description)
  • OS_Processor_Check_Zero - OS Processor Check

Name Response Post-Analysis Lookup
No hosts contacted.
IP Address Status Action
193.233.255.73 Active Moloch

Suricata Alerts

Flow SID Signature Category
TCP 192.168.56.103:49164 -> 193.233.255.73:80 2047625 ET MALWARE [ANY.RUN] Win32/Stealc Checkin (POST) A Network Trojan was detected
TCP 192.168.56.103:49164 -> 193.233.255.73:80 2018358 ET HUNTING GENERIC SUSPICIOUS POST to Dotted Quad with Fake Browser 1 Potentially Bad Traffic

Suricata TLS

No Suricata TLS

pdb_path C:\fwqf1i40yva\RevoInstall.pdb
section .799
section .577
section .00cfg
packer Microsoft Visual C++ V8.0 (Debug)
suspicious_features POST method with no referer header, Connection to IP address suspicious_request POST http://193.233.255.73/loghub/master
request POST http://193.233.255.73/loghub/master
request POST http://193.233.255.73/loghub/master
Time & API Arguments Status Return Repeated

NtProtectVirtualMemory

 process_identifier: 2060
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x75931000
process_handle: 0xffffffff
1 0 0

NtProtectVirtualMemory

 process_identifier: 2060
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x76e01000
process_handle: 0xffffffff
1 0 0

NtProtectVirtualMemory

 process_identifier: 2060
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x752e1000
process_handle: 0xffffffff
1 0 0
description (no description) rule DebuggerCheck__GlobalFlags
description (no description) rule DebuggerCheck__QueryInfo
description (no description) rule DebuggerHiding__Thread
description (no description) rule DebuggerHiding__Active
description (no description) rule ThreadControl__Context
description (no description) rule SEH__vectored
description Checks if being debugged rule anti_dbg
description Bypass DEP rule disable_dep
host 193.233.255.73
Time & API Arguments Status Return Repeated

NtAllocateVirtualMemory

 process_identifier: 2060
region_size: 204800
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x00400000
allocation_type: 12288 (MEM_COMMIT|MEM_RESERVE)
process_handle: 0x0000009c
1 0 0
Time & API Arguments Status Return Repeated

WriteProcessMemory

 buffer: MZÿÿ¸@º´ Í!¸LÍ!This program cannot be run in DOS mode. $àž ¤ÿmY¤ÿmY¤ÿmYwnX¨ÿmYwhX2ÿmYwiX°ÿmYY¦ÿmYhX‚ÿmYiXµÿmYnX°ÿmYwlX§ÿmY¤ÿlYðÿmY°€dX´ÿmY°€’Y¥ÿmY°€oX¥ÿmYRich¤ÿmYPELÖT5eà $*¸A@@ @L›(ààðÐ/à @@.text)* `.rdataxa@b.@@.datah#°@À.rsrcààž@@.relocÐ/ð0 @B
base_address: 0x00400000
process_identifier: 2060
process_handle: 0x0000009c
1 1 0

WriteProcessMemory

 buffer: ÿÿÿÿ±¿DNæ@»ÿÿÿÿ “ ÿÿÿÿ abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ¤`‚y‚!¦ß¡¥Ÿàü@~€ü¨Á£Ú£ þ@þµÁ£Ú£ þAþ¶Ï¢ä¢å¢è¢[þ@~¡þQQÚ^Ú _ÚjÚ2ÓØÞàù1~þˆZB@¶B@¶B@¶B@¶B@¶BH¶B]Bˆ^BÈTB€µB`°BC˜¶BHÇBHÇBHÇBHÇBHÇBHÇBHÇBHÇBHÇBœ¶BLÇBLÇBLÇBLÇBLÇBLÇBLÇB..þÿÿÿ   þÿÿÿu˜ŠÐù¾cyåú¦eÍiL’Ś?þDVƒÐü!ŠÊû‰×6}¼™$Áªaк;ëZèy©Ä*@éã¶úæô€;Ž;¥¹Ò3[ 1œà©Üށ—Ù#,s—s3WILȽy+  qPøkú¢¼ÇmµúÂÆâs5†}àO£td€ïˆôfGj}Ɂ¬:ø÷¹â&÷c&ÀǙ@z‘ÞcÅgÓÑëGïNn3g“ ‰|ÔZز¤G> bŠ&}LºF‰w‹XÍ|[x¦D@q#4m$>äÂö>/ö8Iå¸7МGñD¨íòDñ¥Ñ&\qÀÒJ²Z $\ÒVi×´v8·´ˆÆ &À‡ÿ>̐<[ÏlEfMdý|îoK¡JnÜnÔϯ ïµÃFòÜxAayÛO†w(ì³Ö-ÆÆõA5«V¥0½REA“ãýñbG-¨¦¥ [Êþdã0[okû€hn¤ÛB ±±!S^¥4\Áéj8ªJÛ®!2ɘ€)C…¨”ñgÕ{@ÜMZ¶ß?…þŒ÷‘}M¯­„,ëï—õ*ž Û³OS*÷=B˜9Àc\#ŒÃ\9§ 0b;–(Ïÿ©(ÎZ﨏™ðšóe^4>ØxšúI"WÂB°%/힯¼áy?Ó( —ÖüM݋ð·7¢ —–…L{éü=ž·Ë¡gǃmPvl|S╏ DÄêq¯”o“ùŽ¾„Ì •!sœì©M7<wòÂ,-•–€<L1Ò ¿ü†/’˜w̓ð¹DPÐò°=þoʟÐðҌ¶eÆzoaªd>aùr)0Þ sÉzdÎD8@¸Þ¿åK@X›¥³jj&å™"Šª¯L¤E©ÊæpÏ_éKr¢•O‰Ý›TmªƒÛªuZE)J2^D{ðR¤%•£‚§õ…¼wX…˜"Æ®ë"~"ê<äPu¶ç˜„5G‚}¹‰~ó³œPr<LÌu ítuuDæ…Ôúä„fÂî4Ñ@#j-ÂÒ£ ÑɺgÍZê·í2>[Ììg€u‚„½C*PHçëhºö-€áN($q$ãeË°þm*â˜k3²Jd‰¼I?Ó#J€0ÊD’êQâZb&'ԋ ¦g¡Æ^_/|ŽB.?AVbad_exception@std@@|ŽB.?AVexception@std@@|ŽB.?AVtype_info@@
base_address: 0x0042b000
process_identifier: 2060
process_handle: 0x0000009c
1 1 0

WriteProcessMemory

 buffer: €0€ H`à}<?xml version='1.0' encoding='UTF-8' standalone='yes'?> <assembly xmlns='urn:schemas-microsoft-com:asm.v1' manifestVersion='1.0'> <trustInfo xmlns="urn:schemas-microsoft-com:asm.v3"> <security> <requestedPrivileges> <requestedExecutionLevel level='asInvoker' uiAccess='false' /> </requestedPrivileges> </security> </trustInfo> </assembly>
base_address: 0x0042e000
process_identifier: 2060
process_handle: 0x0000009c
1 1 0

WriteProcessMemory

 buffer: @
base_address: 0xfffde008
process_identifier: 2060
process_handle: 0x0000009c
1 1 0
Time & API Arguments Status Return Repeated

WriteProcessMemory

 buffer: MZÿÿ¸@º´ Í!¸LÍ!This program cannot be run in DOS mode. $àž ¤ÿmY¤ÿmY¤ÿmYwnX¨ÿmYwhX2ÿmYwiX°ÿmYY¦ÿmYhX‚ÿmYiXµÿmYnX°ÿmYwlX§ÿmY¤ÿlYðÿmY°€dX´ÿmY°€’Y¥ÿmY°€oX¥ÿmYRich¤ÿmYPELÖT5eà $*¸A@@ @L›(ààðÐ/à @@.text)* `.rdataxa@b.@@.datah#°@À.rsrcààž@@.relocÐ/ð0 @B
base_address: 0x00400000
process_identifier: 2060
process_handle: 0x0000009c
1 1 0
Bkav W32.AIDetectMalware
Symantec ML.Attribute.HighConfidence
Elastic malicious (high confidence)
ESET-NOD32 a variant of Win32/Kryptik.HUYH
APEX Malicious
Cynet Malicious (score: 100)
Kaspersky VHO:Trojan-PSW.Win32.Convagent.gen
Avast Win32:CrypterX-gen [Trj]
SentinelOne Static AI - Suspicious PE
Google Detected
ZoneAlarm VHO:Trojan-PSW.Win32.Convagent.gen
Microsoft Trojan:Win32/Sabsik.FL.B!ml
Varist W32/Injector.BQY.gen!Eldorado
VBA32 BScope.TrojanPSW.RedLine
Panda Trj/Genetic.gen
Rising Trojan.SmokeLoader!1.EB50 (CLASSIC)
MaxSecure Trojan.Malware.300983.susgen
Fortinet W32/Kryptik.HUKQ!tr
AVG Win32:CrypterX-gen [Trj]
Process injection Process 1932 called NtSetContextThread to modify thread in remote process 2060
Time & API Arguments Status Return Repeated

NtSetContextThread

 registers.eip: 2005598660
registers.esp: 3407352
registers.edi: 0
registers.eax: 4198977
registers.ebp: 0
registers.edx: 0
registers.ebx: -139264
registers.esi: 0
registers.ecx: 0
thread_handle: 0x00000098
process_identifier: 2060
1 0 0
Process injection Process 1932 resumed a thread in remote process 2060
Time & API Arguments Status Return Repeated

NtResumeThread

 thread_handle: 0x00000098
suspend_count: 1
process_identifier: 2060
1 0 0
Time & API Arguments Status Return Repeated

CreateProcessInternalW

 thread_identifier: 2064
thread_handle: 0x00000098
process_identifier: 2060
current_directory:
filepath: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
track: 1
command_line:
filepath_r: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
stack_pivoted: 0
creation_flags: 4 (CREATE_SUSPENDED)
inherit_handles: 0
process_handle: 0x0000009c
1 1 0

NtGetContextThread

 thread_handle: 0x00000098
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2060
region_size: 204800
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x00400000
allocation_type: 12288 (MEM_COMMIT|MEM_RESERVE)
process_handle: 0x0000009c
1 0 0

WriteProcessMemory

 buffer: MZÿÿ¸@º´ Í!¸LÍ!This program cannot be run in DOS mode. $àž ¤ÿmY¤ÿmY¤ÿmYwnX¨ÿmYwhX2ÿmYwiX°ÿmYY¦ÿmYhX‚ÿmYiXµÿmYnX°ÿmYwlX§ÿmY¤ÿlYðÿmY°€dX´ÿmY°€’Y¥ÿmY°€oX¥ÿmYRich¤ÿmYPELÖT5eà $*¸A@@ @L›(ààðÐ/à @@.text)* `.rdataxa@b.@@.datah#°@À.rsrcààž@@.relocÐ/ð0 @B
base_address: 0x00400000
process_identifier: 2060
process_handle: 0x0000009c
1 1 0

WriteProcessMemory

 buffer:
base_address: 0x00401000
process_identifier: 2060
process_handle: 0x0000009c
1 1 0

WriteProcessMemory

 buffer:
base_address: 0x00424000
process_identifier: 2060
process_handle: 0x0000009c
1 1 0

WriteProcessMemory

 buffer: ÿÿÿÿ±¿DNæ@»ÿÿÿÿ “ ÿÿÿÿ abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ¤`‚y‚!¦ß¡¥Ÿàü@~€ü¨Á£Ú£ þ@þµÁ£Ú£ þAþ¶Ï¢ä¢å¢è¢[þ@~¡þQQÚ^Ú _ÚjÚ2ÓØÞàù1~þˆZB@¶B@¶B@¶B@¶B@¶BH¶B]Bˆ^BÈTB€µB`°BC˜¶BHÇBHÇBHÇBHÇBHÇBHÇBHÇBHÇBHÇBœ¶BLÇBLÇBLÇBLÇBLÇBLÇBLÇB..þÿÿÿ   þÿÿÿu˜ŠÐù¾cyåú¦eÍiL’Ś?þDVƒÐü!ŠÊû‰×6}¼™$Áªaк;ëZèy©Ä*@éã¶úæô€;Ž;¥¹Ò3[ 1œà©Üށ—Ù#,s—s3WILȽy+  qPøkú¢¼ÇmµúÂÆâs5†}àO£td€ïˆôfGj}Ɂ¬:ø÷¹â&÷c&ÀǙ@z‘ÞcÅgÓÑëGïNn3g“ ‰|ÔZز¤G> bŠ&}LºF‰w‹XÍ|[x¦D@q#4m$>äÂö>/ö8Iå¸7МGñD¨íòDñ¥Ñ&\qÀÒJ²Z $\ÒVi×´v8·´ˆÆ &À‡ÿ>̐<[ÏlEfMdý|îoK¡JnÜnÔϯ ïµÃFòÜxAayÛO†w(ì³Ö-ÆÆõA5«V¥0½REA“ãýñbG-¨¦¥ [Êþdã0[okû€hn¤ÛB ±±!S^¥4\Áéj8ªJÛ®!2ɘ€)C…¨”ñgÕ{@ÜMZ¶ß?…þŒ÷‘}M¯­„,ëï—õ*ž Û³OS*÷=B˜9Àc\#ŒÃ\9§ 0b;–(Ïÿ©(ÎZ﨏™ðšóe^4>ØxšúI"WÂB°%/힯¼áy?Ó( —ÖüM݋ð·7¢ —–…L{éü=ž·Ë¡gǃmPvl|S╏ DÄêq¯”o“ùŽ¾„Ì •!sœì©M7<wòÂ,-•–€<L1Ò ¿ü†/’˜w̓ð¹DPÐò°=þoʟÐðҌ¶eÆzoaªd>aùr)0Þ sÉzdÎD8@¸Þ¿åK@X›¥³jj&å™"Šª¯L¤E©ÊæpÏ_éKr¢•O‰Ý›TmªƒÛªuZE)J2^D{ðR¤%•£‚§õ…¼wX…˜"Æ®ë"~"ê<äPu¶ç˜„5G‚}¹‰~ó³œPr<LÌu ítuuDæ…Ôúä„fÂî4Ñ@#j-ÂÒ£ ÑɺgÍZê·í2>[Ììg€u‚„½C*PHçëhºö-€áN($q$ãeË°þm*â˜k3²Jd‰¼I?Ó#J€0ÊD’êQâZb&'ԋ ¦g¡Æ^_/|ŽB.?AVbad_exception@std@@|ŽB.?AVexception@std@@|ŽB.?AVtype_info@@
base_address: 0x0042b000
process_identifier: 2060
process_handle: 0x0000009c
1 1 0

WriteProcessMemory

 buffer: €0€ H`à}<?xml version='1.0' encoding='UTF-8' standalone='yes'?> <assembly xmlns='urn:schemas-microsoft-com:asm.v1' manifestVersion='1.0'> <trustInfo xmlns="urn:schemas-microsoft-com:asm.v3"> <security> <requestedPrivileges> <requestedExecutionLevel level='asInvoker' uiAccess='false' /> </requestedPrivileges> </security> </trustInfo> </assembly>
base_address: 0x0042e000
process_identifier: 2060
process_handle: 0x0000009c
1 1 0

WriteProcessMemory

 buffer:
base_address: 0x0042f000
process_identifier: 2060
process_handle: 0x0000009c
1 1 0

WriteProcessMemory

 buffer: @
base_address: 0xfffde008
process_identifier: 2060
process_handle: 0x0000009c
1 1 0

NtSetContextThread

 registers.eip: 2005598660
registers.esp: 3407352
registers.edi: 0
registers.eax: 4198977
registers.ebp: 0
registers.edx: 0
registers.ebx: -139264
registers.esi: 0
registers.ecx: 0
thread_handle: 0x00000098
process_identifier: 2060
1 0 0

NtResumeThread

 thread_handle: 0x00000098
suspend_count: 1
process_identifier: 2060
1 0 0