Summary | ZeroBOX

Category	Machine	Started	Completed
FILE	s1_win7_x6403_us	Nov. 2, 2023, 10:09 a.m.	Nov. 2, 2023, 10:11 a.m.

Size	99.5KB
Type	PE32 executable (GUI) Intel 80386, for MS Windows
MD5	`57c76226a25c44ea73d0ffd2b8258a56`
SHA256	`24c31e8d645268f9b40c348887aebe9eacf476b25c52e904ca90967a97ca0165`
CRC32	`63ED5F36`
ssdeep	`1536:23P7aiRdDxXp2yc9q6qT+Ry0844UudNH6GLHWVE0UXD:29dZv9W844bdNvLHWVE06D`
Yara	Malicious_Library_Zero - Malicious_Library UPX_Zero - UPX packed file Malicious_Packer_Zero - Malicious Packer Network_Downloader - File Downloader PE_Header_Zero - PE File Signature IsPE32 - (no description) Ave_Maria_Zero - Remote Access Trojan that is also called WARZONE RAT OS_Processor_Check_Zero - OS Processor Check Generic_Malware_Zero - Generic Malware

Klv-sailor-warzone123456.txt.exe "C:\Users\test22\AppData\Local\Temp\Klv-sailor-warzone123456.txt.exe"
804
- images.exe "C:\ProgramData\images.exe"
  2080
  - cmd.exe "C:\Windows\System32\cmd.exe"
    2136
explorer.exe C:\Windows\Explorer.EXE
1236

Name	Response	Post-Analysis Lookup
segun.ddns.net	A 185.106.123.197	185.106.123.197

IP Address	Status	Action
164.124.101.2	Active	Moloch
185.106.123.197	Active	Moloch

Suricata Alerts

Flow	SID	Signature	Category
UDP 192.168.56.103:52760 -> 164.124.101.2:53	2028675	ET POLICY DNS Query to DynDNS Domain *.ddns .net	Potentially Bad Traffic
UDP 192.168.56.103:50800 -> 164.124.101.2:53	2028675	ET POLICY DNS Query to DynDNS Domain *.ddns .net	Potentially Bad Traffic

Suricata TLS

No Suricata TLS

Command line console output was observed (3 events)

Time & API	Arguments	Status	Return
WriteConsoleW Nov. 2, 2023, 10:09 a.m.	buffer: Microsoft Windows [Version 6.1.7601] console_handle: 0x00000007	1	1
WriteConsoleW Nov. 2, 2023, 10:09 a.m.	buffer: Copyright (c) 2009 Microsoft Corporation. All rights reserved. console_handle: 0x00000007	1	1
WriteConsoleW Nov. 2, 2023, 10:09 a.m.	buffer: C:\Users\test22\AppData\Local\Temp> console_handle: 0x00000007	1	1

Checks amount of memory in system, this can be used to detect virtual machines that have a low amount of memory available (1 event)

Time & API	Arguments	Status	Return	Repeated
GlobalMemoryStatusEx Nov. 2, 2023, 10:09 a.m.		1	1	0

The file contains an unknown PE resource name possibly indicative of a packer (1 event)

resource name

WM_DSP

Connects to a Dynamic DNS Domain (1 event)

domain

segun.ddns.net

Allocates read-write-execute memory (usually to unpack itself) (2 events)

Time & API	Arguments	Status	Return	Repeated
NtAllocateVirtualMemory Nov. 2, 2023, 10:09 a.m.	process_identifier: 1236 region_size: 65536 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00000000065f0000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1	0	0
NtAllocateVirtualMemory Nov. 2, 2023, 10:09 a.m.	process_identifier: 2080 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x02410000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1	0	0

Foreign language identified in PE resource (1 event)

name

WM_DSP

language

LANG_ENGLISH

filetype

PE32 executable (GUI) Intel 80386, for MS Windows

sublanguage

SUBLANG_ARABIC_QATAR

offset

0x00018070

size

0x00002c00

Creates a suspicious process (1 event)

cmdline

C:\Windows\System32\cmd.exe

A process created a hidden window (1 event)

Time & API	Arguments	Status	Return	Repeated
CreateProcessInternalW Nov. 2, 2023, 10:09 a.m.	thread_identifier: 2140 thread_handle: 0x000001d0 process_identifier: 2136 current_directory: filepath: C:\Windows\System32\cmd.exe track: 1 command_line: filepath_r: C:\Windows\System32\cmd.exe stack_pivoted: 0 creation_flags: 134217728 (CREATE_NO_WINDOW) inherit_handles: 0 process_handle: 0x000001c8	1	1	0

Allocates execute permission to another process indicative of possible code injection (2 events)

Time & API	Arguments	Status	Return	Repeated
NtAllocateVirtualMemory Nov. 2, 2023, 10:09 a.m.	process_identifier: 2136 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00290000 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0x000001d8	1	0	0
NtProtectVirtualMemory Nov. 2, 2023, 10:09 a.m.	process_identifier: 2136 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00290000 process_handle: 0x000001d8	1	0	0

Installs itself for autorun at Windows startup (1 event)

reg_key

HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\Images

reg_value

C:\ProgramData\images.exe

Potential code injection by writing to the memory of another process (2 events)

Time & API	Arguments	Status	Return	Repeated
WriteProcessMemory Nov. 2, 2023, 10:09 a.m.	buffer: UìUEÈÒt ÆAêu÷]ÃUìd¡0ì@SVWxé§G03ö_,?EøB<}ôDxEðÀÁë3ÉÛt-}ø¾ÁÎ <aUø\| ÂÀàðëuøA;ËrßUü}ôEðL3ÛD ÂMìÉt<3ÿÊÀMøÑEè ÁÏ ¾ÁøBÉuñUü}øEø}ôÆ;Et EèC;]ìrÄWUüÒKÿÿÿ3À_^[ÉÂuðD$X·DÂëÝUìì¼ESVWXhLw&M ]¸èèþÿÿðÇEÄkern3ÀÇEÈel32EÐEÞEÄPÇEÌ.dllÇEàntdlÇEäl.dlfÇEèlÇEÔuserÇEØ32.dfÇEÜllfÇEø1fÇEü2ÿÖEàPÿÖEÔPÿÖhX¤SåèyþÿÿhyÌ?EèlþÿÿhEVEôè_þÿÿhDð5àEÀèRþÿÿhî¶PE¤èEþÿÿhÆREè8þÿÿh_xTîEðè+þÿÿhÚöÚOEèþÿÿøhÆp}´èþÿÿh_»ðèþÿÿh-W®[E¼èöýÿÿE¬3ÀPhjPPhSE¨ÿ×jEìPÿÖ]ø}°jh0WjÿÓðötîjE¨PW}ìVWÿU¼WÿUð>M]¸tjEøPPjÿUÀÆEhà.ÿU¤3À}«jDj«««DÿÿÿPèTýÿÿÄÿu jhÿÿÿUE¼ÀuOEPDÿÿÿP3ÀPPPPPPPSÿUôÀ¯PPjPPh@SE¸ÿU´øjÿÿtE¸ë^EüPPjÿUÀéeìMìQPÿU}ìtoEPDÿÿÿP3ÀPPPPPPPSÿUôÀuOPPjPPh@SEÿU´øjÿÿt*EPÿu°VWÿU¬WÿUðEPDÿÿÿP3ÀPPPPPPPSÿUôë EüPPjÿUÀÆEÿu¼ÿUð}åþÿÿ_^[ÉÃä;$dË base_address: 0x00290000 process_identifier: 2136 process_handle: 0x000001d8	1	1	0
WriteProcessMemory Nov. 2, 2023, 10:09 a.m.	buffer: C:\ProgramData\images.exe4÷JèèÌ÷JÌ÷JP,Zu\|,ZuAzkTøJA$igÿÿÿÿÿt÷JXøJ,þJà^\u)Îlþÿÿÿ\|,Zu 5Zuè base_address: 0x002a0000 process_identifier: 2136 process_handle: 0x000001d8	1	1	0

File has been identified by 63 AntiVirus engines on VirusTotal as malicious (50 out of 63 events)

Bkav	W32.AIDetectMalware
Elastic	Windows.Trojan.AveMaria
MicroWorld-eScan	Dropped:Generic.Malware.SLlg.7394ADB1
ClamAV	Win.Malware.Agentb-6970628-1
Skyhigh	BehavesLike.Win32.Generic.nh
McAfee	PWS-FDNF!57C76226A25C
Malwarebytes	Generic.Malware.AI.DDS
VIPRE	Dropped:Generic.Malware.SLlg.7394ADB1
Sangfor	Trojan.Win32.Save.a
K7AntiVirus	Trojan ( 005941d41 )
BitDefender	Dropped:Generic.Malware.SLlg.7394ADB1
K7GW	Trojan ( 005941d41 )
Cybereason	malicious.a99497
VirIT	Trojan.Win32.Dnldr27.DQML
Symantec	Backdoor.Avecma
ESET-NOD32	a variant of Win32/Warzone.A
APEX	Malicious
Cynet	Malicious (score: 100)
Kaspersky	Trojan.Win32.Agentb.jiad
NANO-Antivirus	Trojan.Win32.AntiAV.fljpfv
Rising	Stealer.AveMaria!1.BA1C (CLASSIC)
Emsisoft	Dropped:Generic.Malware.SLlg.7394ADB1 (B)
F-Secure	Trojan.TR/Redcap.ghjpt
DrWeb	Trojan.PWS.Maria.3
Zillya	Trojan.Agentb.Win32.22302
TrendMicro	TrojanSpy.Win32.MOCRT.SM
Trapmine	suspicious.low.ml.score
FireEye	Generic.mg.57c76226a25c44ea
Sophos	Troj/Mocrt-A
SentinelOne	Static AI - Malicious PE
GData	Win32.Backdoor.AveMaria.A
Jiangmin	Trojan.Agentb.eab
Webroot	W32.Trojan.Gen
Google	Detected
Avira	TR/Redcap.ghjpt
MAX	malware (ai score=88)
Antiy-AVL	Trojan/Win32.Agentb
Kingsoft	malware.kb.a.1000
Gridinsoft	Trojan.Win32.Agent.vb!s1
Xcitium	TrojWare.Win32.AntiAV.VA@81mmki
Arcabit	Generic.Malware.SLlg.7394ADB1
ZoneAlarm	Trojan.Win32.Agentb.jiad
Microsoft	Backdoor:Win32/Remcos!MTB
Varist	W32/Antiav.INDT-0919
AhnLab-V3	Trojan/Win32.AveMaria.R263895
Acronis	suspicious
BitDefenderTheta	AI:Packer.6198C1D61F
ALYac	Dropped:Generic.Malware.SLlg.7394ADB1
TACHYON	Trojan-PWS/W32.WarzoneRat.101888
DeepInstinct	MALICIOUS

Connects to IP addresses that are no longer responding to requests (legitimate services will remain up-and-running usually) (18 events)

dead_host	192.168.56.103:49171
dead_host	192.168.56.103:49170
dead_host	192.168.56.103:49181
dead_host	192.168.56.103:49180
dead_host	185.106.123.197:5200
dead_host	192.168.56.103:49173
dead_host	192.168.56.103:49182
dead_host	192.168.56.103:49172
dead_host	192.168.56.103:49177
dead_host	192.168.56.103:49175
dead_host	192.168.56.103:49176
dead_host	192.168.56.103:49165
dead_host	192.168.56.103:49174
dead_host	192.168.56.103:49179
dead_host	192.168.56.103:49169
dead_host	192.168.56.103:49178
dead_host	192.168.56.103:49168
dead_host	192.168.56.103:49166

Klv-sailor-warzone123456.txt.exe

Process Tree Toggle all

Network Toggle all

Suricata Toggle all

Suricata Alerts

Suricata TLS

Signatures Toggle All