popup
Summary | ZeroBOX
  1. Home
  2. Result
  3. Report
  4. Detail Analysis

setup.rar

KeyLogger PWS Escalate priviledges AntiVM AntiDebug
  1. Resubmit sample
Category Machine Started Completed
FILE s1_win7_x6402 Nov. 3, 2023, 5:35 p.m. Nov. 3, 2023, 5:37 p.m.
Size 30.4MB
Type RAR archive data, v5
MD5 d7b36686b22ecf8da8c34bf6d55ad331
SHA256 9ccaee42c525cbfa332db514830fa41ac78f0da4f8bd6e7b94574cff5e508822
CRC32 3AF59954
ssdeep 786432:TB6Iwor817zo6k+RLEx4kbFoFgj7BOey2AjcmdysuF:lHLg17zoKoxNAgjVOIodysuF
Yara None matched

Name Response Post-Analysis Lookup
apps.identrust.com
A 61.111.58.35
CNAME a1952.dscq.akamai.net
CNAME identrust.edgesuite.net
A 61.111.58.34
23.67.53.17
ironhost.io
A 104.21.57.237
A 172.67.193.129
172.67.193.129
IP Address Status Action
164.124.101.2 Active Moloch
172.67.193.129 Active Moloch
208.67.104.60 Active Moloch
61.111.58.34 Active Moloch
91.92.243.151 Active Moloch
94.142.138.113 Active Moloch
94.142.138.131 Active Moloch

Suricata Alerts

Flow SID Signature Category
TCP 192.168.56.102:49180 -> 91.92.243.151:80 2045779 ET MALWARE Win32/BeamWinHTTP CnC Activity M2 (GET) Malware Command and Control Activity Detected
TCP 192.168.56.102:49181 -> 172.67.193.129:443 906200054 SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) undefined

Suricata TLS

Flow Issuer Subject Fingerprint
TLSv1
192.168.56.102:49181
172.67.193.129:443 		C=US, O=Let's Encrypt, CN=E1 CN=ironhost.io bf:96:55:fe:92:31:2c:3b:86:d9:a5:21:ac:2a:4c:b7:56:b7:9e:19

Time & API Arguments Status Return Repeated

IsDebuggerPresent

 0 0
Time & API Arguments Status Return Repeated

GlobalMemoryStatusEx

 1 1 0
suspicious_features Connection to IP address suspicious_request GET http://91.92.243.151/api/tracemap.php
request GET http://91.92.243.151/api/tracemap.php
request GET http://apps.identrust.com/roots/dstrootcax3.p7c
Time & API Arguments Status Return Repeated

NtProtectVirtualMemory

 process_identifier: 2228
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x74002000
process_handle: 0xffffffff
1 0 0

NtProtectVirtualMemory

 process_identifier: 2228
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x721c3000
process_handle: 0xffffffff
1 0 0
file C:\Users\test22\AppData\Local\Temp\7zE4B879236\Templates\RenoirCore.WindowsDesktop — копия.dll
file C:\Users\test22\AppData\Local\Temp\7zE4B879236\Setup.exe
file C:\Users\test22\AppData\Local\Temp\7zE4B879236\Templates\lgc_api — копия.dll
file C:\Users\test22\AppData\Local\Temp\7zE4B879236\Templates\RenoirCore.WindowsDesktop.dll
file C:\Users\test22\AppData\Local\Temp\7zE4B879236\Templates\aadtb — копия.dll
file C:\Users\test22\AppData\Local\Temp\7zE4B879236\Templates\vivoxsdk.dll
file C:\Users\test22\AppData\Local\Temp\7zE4B879236\Templates\lgc_api.dll
file C:\Users\test22\AppData\Local\Temp\7zE4B879236\Templates\vivoxsdk — копия.dll
file C:\Users\test22\AppData\Local\Temp\7zE4B879236\Templates\ResIL — копия.dll
file C:\Users\test22\AppData\Local\Temp\7zE4B879236\Templates\dbghelp — копия.dll
file C:\Users\test22\AppData\Local\Temp\7zE4B879236\Templates\dbghelp.dll
file C:\Users\test22\AppData\Local\Temp\7zE4B879236\Templates\ResIL.dll
file C:\Users\test22\AppData\Local\Temp\7zE4B879236\Templates\aadtb.dll
Time & API Arguments Status Return Repeated

LookupPrivilegeValueW

 system_name:
privilege_name: SeRestorePrivilege
1 1 0

LookupPrivilegeValueW

 system_name:
privilege_name: SeSecurityPrivilege
1 1 0
description Escalate priviledges rule Escalate_priviledges
description PWS Memory rule Generic_PWS_Memory_Zero
description (no description) rule DebuggerCheck__GlobalFlags
description (no description) rule DebuggerCheck__QueryInfo
description (no description) rule DebuggerHiding__Thread
description (no description) rule DebuggerHiding__Active
description (no description) rule ThreadControl__Context
description (no description) rule SEH__vectored
description Checks if being debugged rule anti_dbg
description Bypass DEP rule disable_dep
description Run a KeyLogger rule KeyLogger
host 208.67.104.60
host 91.92.243.151
host 94.142.138.113
host 94.142.138.131
dead_host 208.67.104.60:80
dead_host 192.168.56.102:49183