Summary | ZeroBOX

Category	Machine	Started	Completed
FILE	s1_win7_x6401	Nov. 7, 2023, 7:44 a.m.	Nov. 7, 2023, 7:55 a.m.

Size	744.0KB
Type	PE32 executable (GUI) Intel 80386, for MS Windows
MD5	`a22595ce0f38b327951c42e18ad3eaaf`
SHA256	`7a20db5d819b030f6b5a73104a5519d58743282a54aacfc444adf459ad5168bd`
CRC32	`C1B61B75`
ssdeep	`12288:NusT4cgRdrEAzvHG4zhsT4cgRdrEAzvHG4zj4Btw2YPRKOu7b6WF:NusGRdrEAbm4zhsGRdrEAbm4zj4BGTu1`
Yara	UPX_Zero - UPX packed file Admin_Tool_IN_Zero - Admin Tool Sysinternals PE_Header_Zero - PE File Signature IsPE32 - (no description) Raccoon_Stealer_1_Zero - Raccoon Stealer Generic_Malware_Zero - Generic Malware

Protected.exe "C:\Users\test22\AppData\Local\Temp\Protected.exe"
2548
- Protected.exe "C:\Users\test22\AppData\Local\Temp\Protected.exe"
  2716

Name	Response	Post-Analysis Lookup
www.alphax.studio
www.frigologs.net	CNAME frigologs.net A 186.24.219.13	186.24.219.13
www.girls-at-a.click	A 192.64.119.254	192.64.119.254
www.susanlwhite.com	CNAME susanlwhite.com A 3.33.130.190 A 15.197.148.33	15.197.148.33

IP Address	Status	Action
164.124.101.2	Active	Moloch
186.24.219.13	Active	Moloch
192.64.119.254	Active	Moloch
3.33.130.190	Active	Moloch

Suricata Alerts

Flow	SID	Signature	Category
TCP 192.168.56.101:49169 -> 3.33.130.190:80	2031412	ET MALWARE FormBook CnC Checkin (GET)	Malware Command and Control Activity Detected
TCP 192.168.56.101:49166 -> 186.24.219.13:80	2031412	ET MALWARE FormBook CnC Checkin (GET)	Malware Command and Control Activity Detected
TCP 192.64.119.254:80 -> 192.168.56.101:49165	2035208	ET INFO Namecheap URL Forward	Misc activity
TCP 192.168.56.101:49165 -> 192.64.119.254:80	2031412	ET MALWARE FormBook CnC Checkin (GET)	Malware Command and Control Activity Detected

Suricata TLS

No Suricata TLS

One or more potentially interesting buffers were extracted, these generally contain injected code, configuration data, etc.

HTTP traffic contains suspicious features which may be indicative of malware related traffic (3 events)

suspicious_features	GET method with no useragent header	suspicious_request	GET http://www.girls-at-a.click/rc2i/?8pgH7lkH=E/1tO4wckFnUj5r6Mek1MK6qxqh+MNpqxX62qUo/yHILb4RDko+mEDIRwUXasmHYtjE3r6zq&2db=X4XDHTl0
suspicious_features	GET method with no useragent header	suspicious_request	GET http://www.frigologs.net/rc2i/?8pgH7lkH=JMuXra6KLloehiIxah32YYIrpkp4yqFQBWLG4SlpgDQ2uypTth0DZqxKn0UMZge3bEIRVVry&2db=X4XDHTl0
suspicious_features	GET method with no useragent header	suspicious_request	GET http://www.susanlwhite.com/rc2i/?8pgH7lkH=MaOYfyBNes/ubUN0ufXoKAAMFsk0xNTDfGl/3JxviWmCwgRY/0dIDwWxnHwhgmI11BxwuOlp&2db=X4XDHTl0

Performs some HTTP requests (3 events)

request	GET http://www.girls-at-a.click/rc2i/?8pgH7lkH=E/1tO4wckFnUj5r6Mek1MK6qxqh+MNpqxX62qUo/yHILb4RDko+mEDIRwUXasmHYtjE3r6zq&2db=X4XDHTl0
request	GET http://www.frigologs.net/rc2i/?8pgH7lkH=JMuXra6KLloehiIxah32YYIrpkp4yqFQBWLG4SlpgDQ2uypTth0DZqxKn0UMZge3bEIRVVry&2db=X4XDHTl0
request	GET http://www.susanlwhite.com/rc2i/?8pgH7lkH=MaOYfyBNes/ubUN0ufXoKAAMFsk0xNTDfGl/3JxviWmCwgRY/0dIDwWxnHwhgmI11BxwuOlp&2db=X4XDHTl0

Allocates read-write-execute memory (usually to unpack itself) (45 events)

Time & API	Arguments	Status
NtProtectVirtualMemory Nov. 7, 2023, 7:44 a.m.	process_identifier: 2548 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x73bc2000 process_handle: 0xffffffff	1
NtAllocateVirtualMemory Nov. 7, 2023, 7:44 a.m.	process_identifier: 2548 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00650000 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0xffffffff	1
NtProtectVirtualMemory Nov. 7, 2023, 7:44 a.m.	process_identifier: 2548 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x76f2f000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Nov. 7, 2023, 7:44 a.m.	process_identifier: 2548 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00946000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Nov. 7, 2023, 7:44 a.m.	process_identifier: 2548 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x7294a000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Nov. 7, 2023, 7:44 a.m.	process_identifier: 2548 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00946000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Nov. 7, 2023, 7:44 a.m.	process_identifier: 2548 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0092d000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Nov. 7, 2023, 7:44 a.m.	process_identifier: 2548 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0092d000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Nov. 7, 2023, 7:44 a.m.	process_identifier: 2548 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00405000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Nov. 7, 2023, 7:44 a.m.	process_identifier: 2548 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00946000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Nov. 7, 2023, 7:44 a.m.	process_identifier: 2548 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0092d000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Nov. 7, 2023, 7:44 a.m.	process_identifier: 2548 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0092d000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Nov. 7, 2023, 7:44 a.m.	process_identifier: 2548 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00405000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Nov. 7, 2023, 7:44 a.m.	process_identifier: 2548 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00941000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Nov. 7, 2023, 7:44 a.m.	process_identifier: 2548 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0092d000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Nov. 7, 2023, 7:44 a.m.	process_identifier: 2548 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0092d000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Nov. 7, 2023, 7:44 a.m.	process_identifier: 2548 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00405000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Nov. 7, 2023, 7:44 a.m.	process_identifier: 2548 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00941000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Nov. 7, 2023, 7:44 a.m.	process_identifier: 2548 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0092d000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Nov. 7, 2023, 7:44 a.m.	process_identifier: 2548 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0092d000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Nov. 7, 2023, 7:44 a.m.	process_identifier: 2548 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00405000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Nov. 7, 2023, 7:44 a.m.	process_identifier: 2548 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00941000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Nov. 7, 2023, 7:44 a.m.	process_identifier: 2548 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0092d000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Nov. 7, 2023, 7:44 a.m.	process_identifier: 2548 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0092d000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Nov. 7, 2023, 7:44 a.m.	process_identifier: 2548 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00405000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Nov. 7, 2023, 7:44 a.m.	process_identifier: 2548 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00941000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Nov. 7, 2023, 7:44 a.m.	process_identifier: 2548 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0092d000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Nov. 7, 2023, 7:44 a.m.	process_identifier: 2548 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0092d000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Nov. 7, 2023, 7:44 a.m.	process_identifier: 2548 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00405000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Nov. 7, 2023, 7:44 a.m.	process_identifier: 2548 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00941000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Nov. 7, 2023, 7:44 a.m.	process_identifier: 2548 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0092d000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Nov. 7, 2023, 7:44 a.m.	process_identifier: 2548 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0092d000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Nov. 7, 2023, 7:44 a.m.	process_identifier: 2548 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00405000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Nov. 7, 2023, 7:44 a.m.	process_identifier: 2548 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00941000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Nov. 7, 2023, 7:44 a.m.	process_identifier: 2548 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0092d000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Nov. 7, 2023, 7:44 a.m.	process_identifier: 2548 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0092d000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Nov. 7, 2023, 7:44 a.m.	process_identifier: 2548 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00405000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Nov. 7, 2023, 7:44 a.m.	process_identifier: 2548 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00941000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Nov. 7, 2023, 7:44 a.m.	process_identifier: 2548 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0092d000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Nov. 7, 2023, 7:44 a.m.	process_identifier: 2548 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0092d000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Nov. 7, 2023, 7:44 a.m.	process_identifier: 2548 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00405000 process_handle: 0xffffffff	1
NtAllocateVirtualMemory Nov. 7, 2023, 7:44 a.m.	process_identifier: 2548 region_size: 8192 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x01f20000 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Nov. 7, 2023, 7:44 a.m.	process_identifier: 2716 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x003a0000 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0xffffffff	1
NtProtectVirtualMemory Nov. 7, 2023, 7:44 a.m.	process_identifier: 2716 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x76f2f000 process_handle: 0xffffffff	1
NtAllocateVirtualMemory Nov. 7, 2023, 7:44 a.m.	process_identifier: 2716 region_size: 3158016 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x009c0000 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0xffffffff	1

Changes read-write memory protection to read-execute (probably to avoid detection when setting all RWX flags at the same time) (1 event)

Time & API	Arguments	Status	Return	Repeated
NtProtectVirtualMemory Nov. 7, 2023, 7:44 a.m.	process_identifier: 2548 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 length: 24576 protection: 32 (PAGE_EXECUTE_READ) base_address: 0x003b0000 process_handle: 0xffffffff	1	0	0

Checks for the Locally Unique Identifier on the system for a suspicious privilege (1 event)

Time & API	Arguments	Status	Return	Repeated
LookupPrivilegeValueW Nov. 7, 2023, 7:44 a.m.	system_name: privilege_name: SeDebugPrivilege	1	1	0

Yara rule detected in process memory (8 events)

description	Used Formbook[m]	rule	Win_Trojan_Formbook_m_Zero
description	(no description)	rule	DebuggerCheck__GlobalFlags
description	(no description)	rule	DebuggerCheck__QueryInfo
description	(no description)	rule	DebuggerHiding__Thread
description	(no description)	rule	DebuggerHiding__Active
description	(no description)	rule	ThreadControl__Context
description	(no description)	rule	SEH__vectored
description	Bypass DEP	rule	disable_dep

One or more of the buffers contains an embedded PE file (1 event)

buffer

Buffer with sha1: d9a955580c3449a2a05bc42845828fc3d67c39d2

Used NtSetContextThread to modify a thread in a remote process indicative of process injection (2 events)

Time & API	Arguments	Status	Return	Repeated
Process injection	Process 2548 called NtSetContextThread to modify thread in remote process 2716
NtSetContextThread Nov. 7, 2023, 7:44 a.m.	registers.eip: 4386816 registers.esp: 1638384 registers.edi: 0 registers.eax: 4321488 registers.ebp: 0 registers.edx: 0 registers.ebx: 2130567168 registers.esi: 0 registers.ecx: 1995571652 thread_handle: 0x000001a0 process_identifier: 2716	1	0	0

Resumed a suspended thread in a remote process potentially indicative of process injection (2 events)

Time & API	Arguments	Status	Return	Repeated
Process injection	Process 2548 resumed a thread in remote process 2716
NtResumeThread Nov. 7, 2023, 7:44 a.m.	thread_handle: 0x000001a0 suspend_count: 1 process_identifier: 2716	1	0	0

Executed a process and injected code into it, probably while unpacking (7 events)

Time & API	Arguments	Status	Return
NtResumeThread Nov. 7, 2023, 7:44 a.m.	thread_handle: 0x00000168 suspend_count: 1 process_identifier: 2548	1	0
CreateProcessInternalW Nov. 7, 2023, 7:44 a.m.	thread_identifier: 2720 thread_handle: 0x000001a0 process_identifier: 2716 current_directory: filepath: C:\Users\test22\AppData\Local\Temp\Protected.exe track: 1 command_line: filepath_r: C:\Users\test22\AppData\Local\Temp\Protected.exe stack_pivoted: 0 creation_flags: 4 (CREATE_SUSPENDED) inherit_handles: 0 process_handle: 0x000001a4	1	1
NtGetContextThread Nov. 7, 2023, 7:44 a.m.	thread_handle: 0x000001a0	1	0
NtUnmapViewOfSection Nov. 7, 2023, 7:44 a.m.	base_address: 0x00400000 region_size: 4096 process_identifier: 2716 process_handle: 0x000001a4	1	0
NtMapViewOfSection Nov. 7, 2023, 7:44 a.m.	section_handle: 0x0000019c process_identifier: 2716 commit_size: 0 win32_protect: 64 (PAGE_EXECUTE_READWRITE) buffer: base_address: 0x00400000 allocation_type: 0 () section_offset: 0 view_size: 196608 process_handle: 0x000001a4	1	0
NtSetContextThread Nov. 7, 2023, 7:44 a.m.	registers.eip: 4386816 registers.esp: 1638384 registers.edi: 0 registers.eax: 4321488 registers.ebp: 0 registers.edx: 0 registers.ebx: 2130567168 registers.esi: 0 registers.ecx: 1995571652 thread_handle: 0x000001a0 process_identifier: 2716	1	0
NtResumeThread Nov. 7, 2023, 7:44 a.m.	thread_handle: 0x000001a0 suspend_count: 1 process_identifier: 2716	1	0

Protected.exe

Process Tree Toggle all

Network Toggle all

Suricata Toggle all

Suricata Alerts

Suricata TLS

Signatures Toggle All