popup
Summary | ZeroBOX
  1. Home
  2. Result
  3. Report
  4. Detail Analysis

jurojarem2.1.exe

NSIS Malicious Library UPX PE File OS Processor Check PE32
  1. Resubmit sample
Category Machine Started Completed
FILE s1_win7_x6401 Nov. 21, 2023, 7:52 a.m. Nov. 21, 2023, 7:59 a.m.
Size 572.0KB
Type PE32 executable (GUI) Intel 80386, for MS Windows, Nullsoft Installer self-extracting archive
MD5 0a1d0f4a278dff187347c1544ab3dc6a
SHA256 9ef9b4a8ab8366ea77b049febf61fd2003aa90b9b38f5c301bff8a60a0feef24
CRC32 32289519
ssdeep 12288:HVzaqD3kmx8ROJVT7WPBL4lbeItG74jdzGa0oiN/uucM/9:1zNDv8kJ57W2lb/GQGv5
Yara
  • Malicious_Library_Zero - Malicious_Library
  • IsPE32 - (no description)
  • PE_Header_Zero - PE File Signature
  • NSIS_Installer - Null Soft Installer
  • UPX_Zero - UPX packed file

Name Response Post-Analysis Lookup
geoplugin.net
A 178.237.33.50
178.237.33.50
sheddy1122.ddns.net
A 103.212.81.155
103.212.81.155
IP Address Status Action
103.212.81.155 Active Moloch
164.124.101.2 Active Moloch
178.237.33.50 Active Moloch

Suricata Alerts

Flow SID Signature Category
UDP 192.168.56.101:59002 -> 164.124.101.2:53 2028675 ET POLICY DNS Query to DynDNS Domain *.ddns .net Potentially Bad Traffic
TCP 192.168.56.101:49166 -> 103.212.81.155:6524 2036594 ET JA3 Hash - Remcos 3.x TLS Connection Malware Command and Control Activity Detected

Suricata TLS

Flow Issuer Subject Fingerprint
TLS 1.3
192.168.56.101:49166
103.212.81.155:6524 		None None None

Time & API Arguments Status Return Repeated

GlobalMemoryStatusEx

 1 1 0
section .ndata
suspicious_features GET method with no useragent header suspicious_request GET http://geoplugin.net/json.gp
domain sheddy1122.ddns.net
request GET http://geoplugin.net/json.gp
Time & API Arguments Status Return Repeated

NtProtectVirtualMemory

 process_identifier: 2576
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x73272000
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2636
region_size: 12288
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x003c0000
allocation_type: 12288 (MEM_COMMIT|MEM_RESERVE)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2636
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x003d0000
allocation_type: 12289 (MEM_COMMIT|MEM_RESERVE)
process_handle: 0xffffffff
1 0 0
file C:\Users\test22\AppData\Roaming\oxttdmmhqq\mvvfbkktp.exe
file C:\Users\test22\AppData\Local\Temp\nrcrae.exe
file C:\Users\test22\AppData\Roaming\oxttdmmhqq\mvvfbkktp.exe
reg_key HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run\pyuuennjsc reg_value C:\Users\test22\AppData\Roaming\oxttdmmhqq\mvvfbkktp.exe "C:\Users\test22\AppData\Local\Temp\nrcrae.exe"
Process injection Process 2636 called NtSetContextThread to modify thread in remote process 2716
Time & API Arguments Status Return Repeated

NtSetContextThread

 registers.eip: 1995571652
registers.esp: 1638384
registers.edi: 0
registers.eax: 4409661
registers.ebp: 0
registers.edx: 0
registers.ebx: 2130567168
registers.esi: 0
registers.ecx: 0
thread_handle: 0x000000c8
process_identifier: 2716
1 0 0
Bkav W32.AIDetectMalware
Lionic Trojan.Win32.Strab.4!c
Elastic malicious (high confidence)
MicroWorld-eScan Trojan.NSISX.Spy.Gen.24
Skyhigh BehavesLike.Win32.Generic.hc
ALYac Trojan.NSISX.Spy.Gen.24
Cylance unsafe
VIPRE Trojan.NSISX.Spy.Gen.24
Sangfor Spyware.Win32.Agent.V3sk
Symantec ML.Attribute.HighConfidence
APEX Malicious
Kaspersky UDS:Trojan.Win32.Strab.gen
BitDefender Trojan.NSISX.Spy.Gen.24
Avast FileRepMalware [Rat]
Emsisoft Trojan.NSISX.Spy.Gen.24 (B)
DrWeb Trojan.DownLoader46.33770
FireEye Generic.mg.0a1d0f4a278dff18
Sophos Mal/Generic-S
MAX malware (ai score=80)
Google Detected
Varist W32/Strab.O.gen!Eldorado
Kingsoft malware.kb.a.822
Microsoft Trojan:Win32/Formbook!ml
Arcabit Trojan.NSISX.Spy.Gen.24
ZoneAlarm HEUR:Backdoor.Win32.Remcos.gen
GData Trojan.NSISX.Spy.Gen.24
McAfee Artemis!0A1D0F4A278D
Malwarebytes Generic.Malware/Suspicious
Panda Trj/Chgt.AD
Rising Trojan.Generic@AI.100 (RDML:VAFfLoqcddUQTZKCi3KpAQ)
Fortinet NSIS/Agent.DCAC!tr
BitDefenderTheta Gen:NN.ZexaF.36792.lmW@a4umjin
AVG FileRepMalware [Rat]
DeepInstinct MALICIOUS